The best answer is A because the scenario already points toward unauthorized external communications, so the strongest first corroborating evidence is abnormal network traffic flow. CHFI v11 emphasizes malware indicators, system and network behavior analysis, and monitoring network activities, ports, and DNS as part of malware forensics. While unknown processes running can also be important, the question specifically asks what should be examined first to substantiate an active compromise when suspicious outbound communications are already suspected. Abnormal traffic flows directly support that hypothesis by showing whether the host is beaconing, exfiltrating data, contacting command-and-control infrastructure, or communicating in patterns inconsistent with normal business operations. Browser configuration changes and general system slowdown are weaker, less direct indicators. Slow performance can occur for many benign reasons, whereas suspicious traffic patterns provide stronger evidence of live malicious activity and can also guide scoping across the environment. In CHFI-style reasoning, when network compromise indicators are already present, the most probative next evidence source is the network behavior itself. That makes abnormal traffic flows the strongest answer.

The correct answer is D because Azure AD Audit Logs are designed to record directory-level changes inside the identity-management environment, including administrative modifications to users, groups, applications, and role-related actions. In a privilege-escalation case, investigators need to know who made the change, what was changed, and when it happened. That is exactly the kind of evidence Azure AD Audit Logs are meant to provide. In contrast, Azure AD Sign-in Logs focus on authentication attempts and sign-in context, not administrative change history. Azure Monitor Logs are broader telemetry and analytics sources, while Azure Activity Logs mainly track actions performed on Azure resource management objects at the subscription and resource level. The CHFI v11 blueprint includes cloud forensics, Azure log sources, and acquisition of cloud evidence, so the exam expects candidates to distinguish between identity-plane evidence and infrastructure-plane evidence. Since the question specifically points to changes in the organization’s identity-management environment and administrative role assignments, Azure AD Audit Logs are the most precise and defensible source for forensic review. This is consistent with Microsoft documentation that describes Entra ID audit logs as recording traceable directory changes and helping determine who made a change.

The correct answer is C because the scenario focuses on anti-forensic measures that directly damage the trustworthiness of the evidence itself. If file integrity has been corrupted, important data renamed, and drives encrypted, the central forensic obstacle is that the reliability and integrity of the digital evidence are weakened. CHFI v11 specifically covers anti-forensics techniques and the challenges they create for investigators, including corruption, wiping, encryption, metadata manipulation, and other actions that interfere with accurate interpretation of evidence. Option A describes one possible anti-forensic tactic, but the question emphasizes integrity degradation of the evidence already in hand rather than fabricated redirection. Option B is narrower and speaks more to malware evasion than the broader evidentiary problem described. Option D is overstated and technically inaccurate because timestamp modification does not itself eliminate server logging. In CHFI-style reasoning, when anti-forensics causes examiners to doubt whether data is complete, authentic, or dependable, the most direct challenge is the weakening of evidence integrity and reliability. That is the obstacle best illustrated here.

The correct answer is A because the core obstacle in the scenario is failed attribution. Investigators already have logs and service-side records, yet they still cannot reliably connect those artifacts to a real-world identity. That is one of the defining forensic difficulties of the dark web: its anonymity mechanisms are intentionally designed to obscure user identity and frustrate tracing. The CHFI v11 blueprint includes dark web concepts, TOR operation, risks of investigating the dark web, and dark web forensic challenges. Those objectives prepare candidates to recognize that the biggest barrier is often not the absence of data, but the inability to tie pseudonymous activity to a specific person with confidence. Option C mentions physical location and encrypted networks, which is related, but the question is centered more directly on identity correlation and attribution failure than geolocation. Option B focuses on analyst capability, and option D focuses on tool limitations, neither of which is the main issue described. In CHFI terms, when evidence exists but perpetrators remain unidentifiable because anonymity conceals them, the best answer is that tracing the perpetrators is difficult because the dark web hides their identities.

The correct answer is C because the exit relay is the final Tor relay that sends traffic out to the destination service. Tor’s own documentation states that the website, chat service, email provider, or other destination will see the IP address of the exit relay instead of the actual Tor user. That is exactly why abuse complaints and takedown pressure usually focus on exit relays. Entry guards see the user first, middle relays pass traffic inside the circuit, and bridge nodes help users connect to Tor when normal entry points are blocked, but those components are not normally the publicly visible source IP presented to outside services. CHFI v11 includes dark web concepts, TOR relays, TOR bridge nodes, and the forensic risks of investigating anonymized environments, so understanding relay roles is directly relevant to the exam. In attribution or infrastructure investigations, analysts must know which relay type will appear in third-party logs or external complaints. Since destination systems see the exit node as the apparent source of outbound traffic, the best answer is exit relay.

Option B. RAID 3 is the correct answer because the question describes a RAID level that uses byte-level striping with a dedicated parity disk and requires at least three disks . That combination matches RAID 3. CHFI v11 explicitly includes RAID Storage System , RAID and Virtualization , and the broader understanding of storage structures under digital evidence fundamentals, so candidates are expected to recognize RAID types and how they affect evidence acquisition and recovery.

The key clues are the dedicated parity drive and the fact that the system can continue functioning after a single disk failure . RAID 3 is designed to provide fault tolerance for one failed drive by reconstructing data from the remaining striped disks and the parity information. This makes it different from RAID 0 , which has no redundancy, RAID 1 , which mirrors data rather than using dedicated parity, and RAID 10 , which combines striping and mirroring in a different way.

Because the scenario precisely describes byte-level striping plus one parity disk with single-disk fault tolerance, RAID 3 is the only answer that fully fits the described configuration.

This scenario aligns with CHFI v11 objectives under Anti-Forensics Techniques and Disk and File System Analysis . Attackers and sophisticated users may intentionally hide data in areas of a disk that are not addressed by the operating system, such as inter-partition gaps, slack space, or unallocated space . These techniques are commonly used as anti-forensic methods to conceal illicit data from standard file system views and basic forensic tools.

CHFI v11 emphasizes that such hidden data cannot be accessed through normal OS utilities, disk cleanup tools, or backups that rely on file system structures. Instead, forensic investigators must use disk editor tools or low-level forensic utilities that allow direct sector-by-sector examination of the storage media. Disk editors enable investigators to view raw hexadecimal data, inspect unallocated areas, analyze partition tables, and uncover hidden or deliberately concealed content stored outside recognized partitions.

Reformatting or cleaning the disk would destroy potential evidence and violate forensic principles, while full disk backups alone do not inherently reveal hidden inter-partition data without further low-level analysis. Therefore, consistent with CHFI v11 best practices for uncovering hidden data and countering anti-forensic techniques, using disk editor tools to examine the inter-partition gap is the correct and forensically sound approach.

Option D is the strongest answer because the scenario clearly describes a multi-tenant cloud environment in which the provider failed to properly separate one customer’s resources from another’s. That is the classic problem of insufficient resource isolation . When tenant separation is weak, an attacker can cross boundaries between customer environments, access unauthorized data, and potentially move laterally across shared infrastructure.

This fits the fact pattern far better than the other options. Failure in due diligence concerns poor vendor selection, but the direct technical cause here is not selection error; it is the isolation failure itself. Loss of client control is a general cloud concern but does not specifically explain how the breach occurred. Lack of monitoring may explain why the attack went unnoticed, but it is not the root threat described in the question.

From a CHFI cloud-forensics perspective, investigators must recognize threats linked to multi-tenancy , data segregation failures , and provider-side weaknesses in shared environments. Since the breach affected several accounts because tenant boundaries failed, the correct answer is insufficient resource isolation causing cross-tenant data exposure .

Option D is the most useful answer because it provides the clearest indication that the activity may be part of a larger security issue rather than just routine login failures or missing-file requests. A mod_security entry showing that a rule was triggered for a possible SQL injection attempt directly suggests malicious web-application attack behavior and points to a broader intrusion pattern.

Option C is useful for confirming failed authentication activity, but by itself it may still reflect simple credential guessing or user error. Option B only shows a missing file request, which could be benign or accidental. Option A is the least suspicious of the choices. By contrast, an application firewall or security module explicitly flagging a possible SQL injection attempt strongly indicates that the server may be under targeted attack and that the failed logins could be part of a coordinated campaign.

From a CHFI perspective, log entries that directly indicate known attack techniques are especially valuable during web-server investigations. Therefore, the Apache log entry most likely to help David determine that the failed attempts were tied to a larger security problem is the mod_security alert for possible SQL injection .

The correct answer is D because the signature D0 CF 11 E0 A1 B1 1A E1 identifies the older Microsoft Compound File Binary Format, which can contain several legacy Office file types. The clue that resolves the exact file type here is the presence of a stream named WordDocument, which is characteristic of the legacy binary Microsoft Word document structure. By contrast, a PDF would begin with the text signature %PDF, and a modern .docx file uses the ZIP-based Office Open XML format rather than the older compound binary format. CHFI v11 includes analysis of Word, PDF, and other file formats through hex views, so this question fits directly into that objective. The exam logic is to combine the magic number with the internal stream name rather than relying on the container header alone. Since the fragment is a compound binary file and specifically exposes a WordDocument stream, the most likely associated file type is a Microsoft Word .doc file.