According to the CHFI v11 Network and Web Attacks domain, a directory traversal attack (also known as path traversal) is a web-based attack in which an attacker manipulates input parameters (such as ../ sequences) to access files and directories outside the intended web root . This can expose sensitive resources such as configuration files, credentials, source code, system files, and application logs.
The primary forensic objective when investigating a directory traversal attack is to determine the scope and impact of unauthorized access . CHFI v11 emphasizes that investigators must analyze web server logs, application logs, and access records to identify:
* Which files or directories were accessed
* Whether sensitive or confidential data was exposed
* The time frame of the attack
* The attacker's source IP and request patterns
* Whether data was viewed, downloaded, or potentially modified
Understanding the extent of data compromise is critical for incident response, regulatory notification, damage assessment, and legal proceedings. It also helps determine whether further attacks (such as privilege escalation or lateral movement) may have occurred following the traversal exploit.
The other options are not aligned with forensic goals. Hardware configuration analysis and bandwidth optimization are operational tasks, not forensic objectives. Enhancing user experience is unrelated to incident investigation.
CHFI v11 clearly states that the focus of web attack forensics is impact assessment and evidence reconstruction , making determining unauthorized access and data compromise the correct objective.
Therefore, the correct and CHFI v11-verified answer is Option C .

Option C. Static Analysis is the best initial step. CHFI v11 covers malware forensics , including methods for examining suspicious files to understand their characteristics, indicators, and probable functions. When investigators encounter a novel malware sample with no prior intelligence available, the safest and most logical first step is usually static analysis . This allows the examiner to inspect the file without executing it , reducing the risk of further infection or unintended damage while still revealing useful information such as file type, strings, embedded resources, headers, imports, suspicious metadata, packing indicators, and other structural clues.
Behavioral analysis is also valuable, but it normally comes after an initial static examination because it requires executing or monitoring the sample in a controlled environment. Code analysis can be deeper and more specialized, but it is not always the first practical step, especially before basic triage. Signature analysis is less useful when the malware is believed to be new and may not yet match known indicators.
Therefore, under CHFI malware investigation principles, the most viable initial step to understand a previously unknown malicious file is static analysis before moving to more advanced dynamic techniques.

Option D is the strongest answer because the scenario clearly describes a multi-tenant cloud environment in which the provider failed to properly separate one customer's resources from another's. That is the classic problem of insufficient resource isolation . When tenant separation is weak, an attacker can cross boundaries between customer environments, access unauthorized data, and potentially move laterally across shared infrastructure.
This fits the fact pattern far better than the other options. Failure in due diligence concerns poor vendor selection, but the direct technical cause here is not selection error; it is the isolation failure itself. Loss of client control is a general cloud concern but does not specifically explain how the breach occurred. Lack of monitoring may explain why the attack went unnoticed, but it is not the root threat described in the question.
From a CHFI cloud-forensics perspective, investigators must recognize threats linked to multi-tenancy , data segregation failures , and provider-side weaknesses in shared environments. Since the breach affected several accounts because tenant boundaries failed, the correct answer is insufficient resource isolation causing cross-tenant data exposure .

Option B. Cuckoo Sandbox is the best answer because CHFI v11 explicitly includes Malware Analysis:
Static and Dynamic , the Prominence of Setting up a Controlled Malware Analysis Lab , Preparing Testbed for Malware Analysis , and Tools to Perform Static and Dynamic Malware Analysis . The question specifically asks for behavioral analysis in a secure and controlled environment , which is the hallmark of sandbox-based dynamic malware analysis.
A polymorphic worm that changes structure rapidly is difficult to analyze with signature-based approaches alone, so observing its behavior in a sandbox is the most effective next step. Cuckoo Sandbox is designed for this type of controlled execution and can reveal process activity, file changes, registry modifications, network communications, and persistence behavior without exposing the production environment. Wireshark only captures network traffic. IDA Pro is a reverse engineering tool for code analysis. Process Monitor is useful for local system monitoring but does not provide the same isolated malware-analysis lab capability.
Therefore, under CHFI malware-forensics objectives, Cuckoo Sandbox is the strongest answer for secure behavioral analysis of the worm.

As defined in the CHFI v11 Procedures and Methodology domain, directed collection is an eDiscovery methodology in which investigators deliberately limit evidence collection to specific data sets, file types, directories, custodians, or system areas that are known or highly likely to contain relevant information. This approach is commonly used to reduce data volume, minimize business disruption, and lower legal and operational costs while maintaining forensic relevance.
In the given scenario, the investigator intentionally restricts the scope of ESI by targeting specific directories and file types , rather than collecting full disk images or all user data. CHFI v11 explicitly describes this as directed (or targeted) collection , which is aligned with the Electronic Discovery Reference Model (EDRM) best practices. Directed collection helps investigators remain compliant with legal proportionality requirements and reduces exposure to irrelevant or private third-party data.
The other options do not match the scenario. Custodian self-collection introduces risk and is generally discouraged due to evidence integrity concerns. Incremental collection focuses on changes since a prior collection, not selective scope reduction. Remote acquisition refers to the method of access, not the collection strategy itself.
CHFI v11 emphasizes directed collection as a preferred methodology when investigators already understand where relevant evidence resides and need to collect it efficiently and defensibly. Therefore, the correct and CHFI v11-verified answer is directed collection of definite data sets and system areas , making Option D correct.