212-89 Web Application Incidents — 25 Questions

Question 1

An attacker is using a slow-rate HTTP POST request to exhaust server resources. Which ModSecurity directive should be adjusted to mitigate this behavior?

Accepted Answer

SecRequestBodyLimit. ModSecurity's 'SecRequestBodyLimit' and 'SecRequestBodyNoFilesLimit' manage the size and rate of incoming request bodies.

Answer

SecDataDir

Answer

SecRuleEngine DetectionOnly

Answer

SecResponseBodyLimit

Question 2

You are mitigating a Blind SQL Injection attack. What is the most effective server-side logging configuration change?

Accepted Answer

Disable all error reporting to the end user. Blind SQL injection relies on timing-based responses or differences in content length. Increasing log verbosity for query execution time helps identify these patterns.

Answer

Enable full packet capture on the database server

Answer

Enable verbose SQL query logging with execution timestamps

Answer

Increase the log rotation frequency

Question 3

Which HTTP header is most critical to inspect when identifying the origin of an attack passing through a reverse proxy?

Accepted Answer

X-Forwarded-For. The X-Forwarded-For (XFF) HTTP header is used by reverse proxies and load balancers to carry the original client IP address when forwarding requests to backend servers. Since the backend sees the proxy's IP as the source, XFF is the only header that reveals the true origin of the attack. Inspecting it is critical for identifying the attacker's IP, though it must be trusted only from known proxies because it can be spoofed.

Answer

Referer

Answer

User-Agent

Answer

Host

Question 4

You are performing incident response on a web server compromised via Directory Traversal. What command is most useful for identifying the specific files accessed in the logs?

Accepted Answer

grep -r "../" /var/log/apache2/access.log. Using grep to search for traversal sequences like '../' within the access logs is the standard method for finding these attempts.

Answer

grep -r "SELECT" /var/log/apache2/access.log

Answer

grep -r "<script>" /var/log/apache2/access.log

Answer

tail -f /var/log/auth.log

Question 5

When analyzing an XSS attack, you find that the payload is being injected through a hidden form field. Which WAF policy is best suited to block this?

Accepted Answer

Implement strict field-level input validation for the specific hidden form parameter. Strict field-level input validation for the specific hidden form parameter is the best WAF policy because it targets the exact injection point, ensuring that only expected data is accepted. This prevents XSS payloads from being stored or reflected via that field.

Answer

Enable IP reputation blocking

Answer

Enable URL encoding normalization

Answer

Set the WAF to block all POST requests

Question 6

A user's session is hijacked. Which log attribute is most helpful in confirming the hijack occurred?

Accepted Answer

User-Agent string. The User-Agent string is most helpful because a sudden change in User-Agent during a session can indicate a different client (attacker) is now using the session. Other attributes like IP address can also change due to legitimate reasons (e.g., mobile networks), but User-Agent changes are less common and more indicative of hijacking.

Answer

Request timestamp

Answer

Remote IP address

Answer

HTTP Referer

Question 7

During an investigation of a web application incident, you discover that an attacker exploited a deserialization vulnerability to execute arbitrary code on the server. Which artifact is most critical to examine to understand the exact payload and its execution path?

Accepted Answer

Network packet capture (PCAP). A network packet capture is the most critical artifact because it contains the full HTTP request, including the serialized payload sent to the vulnerable endpoint. This allows you to analyze the exact object and understand how the attacker achieved code execution. Other logs may provide context but do not capture the payload details necessary for a thorough understanding of the deserialization vulnerability.

Answer

Application server error logs

Answer

Database query logs

Answer

Web server access logs

Question 8

During a web application incident, an analyst notices that an attacker is using HTTP Parameter Pollution (HPP) to bypass input validation. Which HTTP method is most commonly associated with HPP attacks?

Accepted Answer

POST. HTTP Parameter Pollution (HPP) occurs when an attacker injects multiple parameters with the same name, and the web application processes them inconsistently. POST requests are most commonly exploited because they carry parameters in the body, allowing attackers to bypass validation or manipulate application logic. This can lead to unauthorized actions or data exposure.

Answer

GET

Answer

PUT

Answer

DELETE

Question 9

During a web application incident, an analyst discovers that an attacker is exploiting a deserialization vulnerability in a Java-based application. Which of the following is the most effective immediate mitigation to prevent further exploitation?

Accepted Answer

Apply a patch to the vulnerable library and restart the application. The most effective immediate mitigation for a deserialization vulnerability is to apply a patch to the vulnerable library. This directly addresses the root cause and prevents exploitation without disrupting legitimate functionality. Restarting the application ensures the patch is active. Other measures like blocking all traffic or crude WAF rules are either too broad or not guaranteed to stop the attack.

Answer

Disable all Java serialization in the application

Answer

Implement a WAF rule to block all requests containing serialized Java objects

Answer

Block all incoming traffic to the application until further notice

Question 10

A web application incident responder is investigating a suspected cross-site request forgery (CSRF) attack. Which two characteristics are most indicative of a CSRF attack in web server logs? (Choose two.)

Accepted Answer

Requests include a Referer header pointing to an external site. CSRF attacks force a victim's browser to send authenticated requests without their consent. Two strong indicators are: a request with a valid session cookie but missing CSRF token, indicating the request did not originate from the application's forms; and a Referer header pointing to an external site, showing the request was initiated from a malicious page. These characteristics help distinguish CSRF from legitimate traffic.

Answer

Requests are sent using the GET method to state-changing endpoints

Answer

Requests are made from the same IP address as the victim's previous requests

Answer

Requests originate from a different domain than the application's domain

Question 11

You are auditing Apache logs to detect potential OS command injection. Which characters should you search for in the access logs?

Accepted Answer

';', '|', '&', and '`'. OS command injection payloads use shell metacharacters to chain or execute additional commands: semicolon (;), pipe (|), ampersand (&), and backtick (`) are the classic separators and command substitution operators. Searching access logs for these characters reveals attempts to append commands like '; cat /etc/passwd' or '| whoami'.

Answer

'%20', '+', and '='

Answer

'{', '}', and '$'

Answer

'<', '>', and '/'

Question 12

During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?

Accepted Answer

Create a granular exclusion for the specific parameter triggering the alert. Creating a targeted exception for a specific URI or parameter prevents over-blocking while keeping the signature active for the rest of the application.

Answer

Disable the entire XSS protection rule set

Answer

Implement a negative security model

Answer

Switch the WAF from Blocking mode to Transparent mode

Question 13

An analyst is investigating a suspected SQL injection attack on an IIS server. Which log file should they prioritize to identify the specific URL-encoded payload strings submitted by the attacker?

Accepted Answer

W3C Extended Log File Format logs. IIS W3C Extended Log File Format logs record the full request URI, including query strings, in the cs-uri-stem and cs-uri-query fields. SQL injection payloads submitted via GET or POST URLs appear URL-encoded here, making this the primary source for identifying the exact attack strings. Analysts parse these logs to extract payloads like %27%20OR%201%3D1.

Answer

Application Event logs

Answer

HTTPERR logs

Answer

Security Event logs

Question 14

A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?

Accepted Answer

Directory traversal or unauthorized access attempts are being blocked. Repeated 403 errors often indicate an attacker performing forced browsing or directory traversal attempts that are being blocked by server-side permission settings.

Answer

The user session has expired

Answer

The requested file does not exist

Answer

The server is offline

Question 15

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

Accepted Answer

A user session ID remains identical before and after a successful authentication event. Session fixation occurs when an attacker sets or knows a victim's session ID before authentication and the application fails to regenerate that ID after login. The primary log indicator is therefore a session ID that remains identical before and after a successful authentication event. This persistence of the pre-authentication session identifier is the defining signature of the vulnerability being exploited.

Answer

High volume of requests to the login page without POST data

Answer

The same session ID is associated with two different IP addresses within a short timeframe

Answer

A sudden spike in failed login attempts

Question 16

An attacker is bypassing WAF signatures by using Unicode encoding. Which WAF feature must be enabled to normalize the traffic before inspection?

Accepted Answer

UTF-8/Unicode normalization. Unicode encoding allows attackers to represent characters in multiple ways (e.g., using full-width characters or overlong UTF-8 sequences) to bypass signature-based WAF rules that look for literal ASCII patterns. Enabling UTF-8/Unicode normalization forces the WAF to convert all input into a canonical form before matching signatures, so obfuscated payloads are decoded and inspected correctly. Without normalization, the WAF sees encoded gibberish and misses the attack.

Answer

Content-Type header inspection

Answer

SSL/TLS offloading

Answer

Request body buffering

Question 17

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

Accepted Answer

Wireshark. Wireshark is a protocol analyzer that captures and decodes live network traffic, allowing real-time inspection of HTTP requests and responses, including payload contents, headers, and body data. It can reassemble TCP streams and apply display filters (e.g., http.request) to isolate malicious payloads as they traverse the wire. This makes it the correct tool for live HTTP traffic analysis.

Answer

Nmap

Answer

Netstat

Answer

Syslog

Question 18

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

Accepted Answer

Referer header showing a domain different from the application's domain. CSRF attacks originate from a different site. Checking the 'Referer' header in the logs for unexpected domains is the primary method for detection.

Answer

Multiple POST requests without a corresponding GET request

Answer

High volume of 401 Unauthorized errors

Answer

A sudden change in the session cookie value

Question 19

What is the primary function of a Web Application Firewall (WAF) in an incident response scenario?

Accepted Answer

Blocking known malicious patterns at the application layer. A WAF inspects HTTP/HTTPS traffic at the application layer (Layer 7) and blocks requests matching known malicious patterns such as SQLi, XSS, and command injection signatures. In incident response, it serves as a containment control that can immediately block ongoing attack traffic while the team investigates. This makes it a key tool for rapid mitigation.

Answer

Storing database backups

Answer

Encrypting all web traffic

Answer

Providing user authentication services

Question 20

A developer reports that a specific user is receiving 500 Internal Server Errors. Where is the first place to look to determine if this is an incident?

Accepted Answer

Error logs. Error logs on the web server or application record 500 Internal Server Error events with stack traces, exception messages, and timestamps, making them the first place to determine whether the error is a benign bug or a sign of an incident (e.g., injection, resource exhaustion).

Answer

Firewall logs

Answer

DNS logs

Answer

Access logs