According to the CHFI v11 Network and Web Application Forensics objectives, IIS (Internet Information Services) logs are a primary source of evidence for reconstructing web activity, identifying attack paths, and understanding user behavior. IIS logs follow the W3C Extended Log File Format , where each field represents a specific attribute of the HTTP request or response.
The field cs(Referer) records the referring URL , which indicates the web page from which the client accessed the requested resource. In this scenario, the value
http://www.techsite.com/assets/img/logo.png
represents the page that referred the request for /images/content/bg_body_1.jpg. This information is crucial in forensic investigations to determine navigation paths, embedded content usage, malicious redirects, cross- site scripting attempts, or unauthorized resource loading .
The other options do not match this value. The server port field would contain a numeric value such as 80 or
443. The cs-method field records the HTTP method (e.g., GET or POST). The cs(User-Agent) field contains browser and operating system details, such as Chrome or Windows version strings.
CHFI v11 emphasizes analyzing cs(Referer) fields to trace attacker movement, identify compromised pages, and correlate web requests during incident reconstruction. Therefore, the value shown in the log entry belongs to the cs(Referer) field, making Option A the correct answer.

Event correlation in CHFI v11 is a critical investigative technique used to reconstruct attack timelines by analyzing and correlating events from multiple log sources. The CHFI blueprint clearly distinguishes between Same-Platform Correlation and Cross-Platform Correlation under the domain of Image/Evidence Examination and Event Correlation .
Cross-Platform Correlation applies when an investigation involves heterogeneous environments , meaning different operating systems, hardware platforms, or network devices are involved in the incident. A common real-world example-explicitly referenced in CHFI training-is an enterprise environment where Windows-based client systems or servers interact with Linux-based infrastructure components such as firewalls, IDS/IPS devices, or proxies . In such cases, investigators must correlate Windows Event Logs with Linux syslogs, firewall logs, and network device records to build a unified timeline of attacker activity.
Option B correctly reflects this scenario by describing the use of Windows servers alongside Linux-based firewalls , which is a textbook example of Cross-Platform Correlation. Option A relates to standardization, not correlation. Option C represents a single-platform environment, and Option D refers to security tooling diversity rather than operating system or platform diversity.
CHFI v11 emphasizes Cross-Platform Correlation as essential for detecting multi-stage attacks , lateral movement, and perimeter breaches in modern hybrid infrastructures, making Option B the correct and exam- aligned answer

Option C is the best answer because the scenario involves multiple jurisdictions , privacy rights , and even diplomatic immunity , which makes strict legal compliance essential. In CHFI methodology, investigators must respect rules of evidence , search and seizure requirements , privacy laws , and the need to obtain lawful authority before accessing systems or seizing digital evidence. When a case crosses borders, coordination with legal counsel and appropriate authorities becomes even more important.
The other options are clearly improper. Waiting for the suspect to leave and then seizing the device without legal authority is not defensible. Remotely accessing the computer without authorization would violate legal and ethical standards. Secretly entering the suspect's residence is also unlawful and would likely render any evidence inadmissible. The urgency of the case does not override legal procedure.
Therefore, the proper first move is to consult legal counsel and seek the necessary warrant or international legal authorization before proceeding. This preserves admissibility, protects the investigation, and aligns with CHFI's focus on lawful evidence handling in complex international cybercrime cases.

Option C. Sysmon is the best answer because CHFI v11 explicitly includes system behavior analysis involving monitoring files and folders , along with monitoring processes, services, startup programs, Windows event logs, API calls, and device drivers . In this scenario, Bob needs a tool that can log file and folder changes on a Windows system so he can understand how the malware modified the environment to hide itself.
Sysmon is designed to generate detailed system activity logs that can help investigators track suspicious changes and correlate them with process execution and other indicators of compromise. That makes it much more appropriate than the other choices. IDA Pro is primarily for reverse engineering binaries, EnCase is a broad forensic suite rather than a dedicated real-time system activity monitor, and FTK Imager focuses on imaging and evidence preview rather than ongoing change logging.
Because the question is specifically about monitoring and logging changes to files and folders , Sysmon is the most direct and CHFI-aligned answer for observing malware behavior at the system level.

This question aligns directly with CHFI v11 objectives under Dark Web Forensics and Tor Browser Forensics
. The Tor Browser is specifically designed to minimize persistent artifacts and anonymize user activity, which makes forensic investigations particularly challenging. CHFI v11 emphasizes that the primary objective in Tor Browser-related investigations is to identify and extract residual artifacts across multiple operational states of the browser.
Investigators must analyze evidence when the Tor Browser is open , closed , and even after uninstallation , because artifacts may exist in different locations depending on the browser's state. Memory dumps can reveal live artifacts such as email content, session data, credentials, and attachments when the browser is running.
Storage analysis can uncover downloaded email attachments, cached files, and remnants left behind after normal usage or uninstallation.
CHFI v11 specifically highlights scenarios involving email forensics with Tor Browser open and closed, memory acquisition, and post-uninstallation analysis as complementary techniques rather than isolated tasks.
Focusing on only one browser state would result in incomplete evidence collection. Therefore, the overarching forensic objective is to explore email artifacts and attachments across various Tor Browser states , making option B the correct and CHFI-aligned answer.