According to the CHFI v11 objectives under Web Application Forensics and Log Analysis , investigators must know the default log storage locations of commonly used web servers. On Windows-based systems , Internet Information Services (IIS) stores its web server logs within the inetpub directory, which resides on the system drive by default. The standard path used by IIS for logging HTTP and HTTPS requests is:
%SystemDrive%\inetpub\logs\LogFiles
In this question, the option %SystemDrive%\inetpub correctly points to the parent directory that contains IIS-related content, including the LogFiles directory where forensic-relevant web access logs are stored. These logs record critical details such as client IP addresses, request methods, requested URLs, HTTP status codes, timestamps, and user agents—key artifacts for reconstructing web-based attacks such as SQL injection, directory traversal, brute-force attempts, and malicious file uploads.
The other options are incorrect because they reference Apache web server configuration files used on Linux or UNIX systems, not IIS. Since the server in question is Windows-based and running IIS, those paths are irrelevant to the investigation.
The CHFI Exam Blueprint v4 explicitly includes IIS web server architecture and log analysis , emphasizing familiarity with default IIS log locations as essential for effective web attack investigations and evidence collection, making Option D the correct and exam-aligned answer
