According to the CHFI v11 Web Application and Linux Forensics objectives , understanding default web server configurations and log locations is essential for investigating web-based attacks. On Ubuntu systems , the Apache web server package is typically installed as apache2 , and its primary configuration file is located at /etc/apache2/apache2.conf .
This configuration file plays a central role in Apache forensics because it defines or references critical settings, including log file locations , logging formats, enabled modules, virtual host configurations, and included configuration directories (such as sites-enabled and conf-enabled). The actual access and error logs are usually stored in /var/log/apache2/access.log and /var/log/apache2/error.log , but the paths to these logs are defined or confirmed through the apache2.conf file and its included configuration files.
The other options are incorrect in the context of Ubuntu. Paths such as /etc/httpd/conf/httpd.conf and /var
/log/httpd/ are associated with Red Hat-based distributions like CentOS and RHEL, not Ubuntu. The path
/usr/local/etc/apache22/httpd.conf is typically seen in BSD-based systems or custom Apache installations, not default Ubuntu deployments.
CHFI v11 emphasizes correlating Apache configuration files with access and error logs to accurately analyze attack vectors, timestamps, and source IP addresses during web application forensic investigations.
Therefore, the correct and CHFI-verified answer is /etc/apache2/apache2.conf (Option D) .