An attacker is using a slow-rate HTTP POST request to exhaust server resources. Which ModSecurity directive should be adjusted to mitigate this behavior?
You are performing incident response on a web server compromised via Directory Traversal. What command is most useful for identifying the specific files accessed in the logs?
During an investigation of a web application incident, you discover that an attacker exploited a deserialization vulnerability to execute arbitrary code on the server. Which artifact is most critical to examine to understand the exact payload and its execution path?
During a web application incident, an analyst notices that an attacker is using HTTP Parameter Pollution (HPP) to bypass input validation. Which HTTP method is most commonly associated with HPP attacks?
During a web application incident, an analyst discovers that an attacker is exploiting a deserialization vulnerability in a Java-based application. Which of the following is the most effective immediate mitigation to prevent further exploitation?
A web application incident responder is investigating a suspected cross-site request forgery (CSRF) attack. Which two characteristics are most indicative of a CSRF attack in web server logs? (Choose two.)
During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?
An analyst is investigating a suspected SQL injection attack on an IIS server. Which log file should they prioritize to identify the specific URL-encoded payload strings submitted by the attacker?
A developer reports that a specific user is receiving 500 Internal Server Errors. Where is the first place to look to determine if this is an incident?
You are reviewing logs after an incident. You see a sequence of requests starting with 'admin.php', then 'admin.php?id=1', then 'admin.php?id=1 OR 1=1'. What is the attacker doing?
A web application's logs indicate an attacker successfully performed an XML External Entity (XXE) injection. What was likely the source of this vulnerability?
During a web application incident, an analyst observes that an attacker is injecting malicious JavaScript into a comment field that is stored and later displayed to other users. Which type of web application incident is this?
A web application is experiencing an incident where an attacker is manipulating HTTP headers to bypass IP-based access controls. The attacker sets the X-Forwarded-For header to a trusted internal IP address. Which mitigation should an incident handler recommend to prevent this bypass?
While responding to a confirmed cross-site scripting (XSS) incident on a public web application, you need to determine whether the attacker exfiltrated session cookies. The application uses HTTPS and sets cookies without the HttpOnly flag. Which evidence source is MOST likely to reveal the stolen cookie values?
An incident responder is investigating a web application breach and needs to determine the exact time an attacker uploaded a web shell. Which log source would most directly provide this information?
During an incident involving a compromised e-commerce web application, you need to determine whether an attacker used a stolen session cookie to access a user's account. Which HTTP header should you examine first in the web server access logs to identify the session token used in the malicious requests?
During an incident involving a compromised web application, you review an Apache access.log entry that shows a request for /admin/config.php with a response code of 200, but the request originated from an external IP address never seen before. The application is configured to require authentication for that path. Which incident response action is MOST appropriate to determine the scope of the compromise?
An incident responder suspects a server-side request forgery (SSRF) incident against an internal web application that fetches remote images by URL. The application runs in a cloud VPC and can reach the instance metadata service. Which immediate containment action BEST reduces the risk of credential theft while preserving evidence?
During a web application incident, an analyst discovers that an attacker is using SQL injection to extract data from a backend database. Which SQL injection technique involves the attacker inferring data by asking the database true/false questions and observing the application's response?
A web application is experiencing an incident where attackers are injecting malicious JavaScript into stored user comments. The application reflects the input without proper sanitization. Which mitigation technique, when implemented correctly, is most effective at preventing this type of attack from executing in victims' browsers?
A web application is behind a reverse proxy that forwards client requests. During an incident, you need to identify the true source IP of an attacker who is sending malicious requests. The web server logs show the IP of the reverse proxy instead of the client. Which HTTP header should you inspect in the web server logs to find the original client IP?
You are handling a confirmed incident in which an attacker uploaded a web shell named 'image_thumb.php' to a public-facing Apache server running PHP. The file is being invoked repeatedly via HTTP POST requests. Which action should you take FIRST to contain the threat while preserving forensic evidence?
You are handling a web defacement incident on an internet-facing content management system. The page content was altered, and the attacker likely used a compromised administrative account. Which TWO artifacts should you collect FIRST to establish an accurate timeline and preserve evidence? (Choose two.)
A web application is under a distributed denial-of-service (DDoS) attack that is overwhelming the server with HTTP requests. As an incident handler, you need to identify the source of the attack and mitigate it. Which TWO log sources are most critical to analyze first to understand the attack pattern and its origin? (Choose two.)
During a web application incident, you discover that an attacker is exfiltrating data through HTTP responses by abusing a deserialization endpoint. The endpoint returns serialized objects that include base64-encoded fields. Which technique should you use to identify the exfiltrated data within captured network traffic?
A web application is experiencing a suspected cross-site scripting (XSS) incident. You are reviewing web server and application logs to identify the attack. Which TWO log sources are MOST likely to contain evidence of the XSS payload being submitted and executed? (Choose two.)
During a web application incident, you review logs and find requests containing the string 'UNION SELECT username, password FROM users' in the id parameter. The database server log shows the corresponding query executed successfully and returned rows. Which type of web application attack does this evidence confirm?
A web application is suspected of being compromised through a file inclusion vulnerability. The attacker has uploaded a web shell to the server. Which type of log should you examine to find evidence of the web shell being accessed and executed?
A web application is returning verbose error messages that include full stack traces and database query fragments to users. An attacker is using these messages to map the application's internal structure. Which remediation step should the incident handler recommend to the development team?
A web application is suspected of being compromised through a file inclusion vulnerability. The attacker used the vulnerability to read sensitive files on the server. Which web server log entry would provide the MOST direct evidence of the file inclusion attempt?
You are investigating a cross-site scripting incident on a customer-facing web application. The attacker injected a persistent payload that executes in the browsers of users viewing a product review page. Which TWO actions should you take to contain the incident and protect users while preserving evidence? (Choose two.)
During an incident involving a web application, you discover that an attacker has uploaded a web shell to the server. You need to determine how the attacker uploaded the file. Which log source would provide the MOST relevant information about the upload mechanism?
A web application incident has been confirmed, and the responder needs to determine whether the attacker accessed sensitive customer records through a vulnerable API endpoint. Which log source should be examined first to identify the specific API calls and parameters used?
During an investigation of a compromised e-commerce web application, you observe that the attacker sent a single HTTP request containing a serialized object in the 'cart' cookie. The application deserialized the data and subsequently spawned a shell process on the server. Which web application vulnerability was exploited?
A web application incident responder is investigating a suspected XML External Entity (XXE) attack. Which component of the web application is most likely to be the initial target of the attack?
A web application is experiencing a denial-of-service attack characterized by a flood of HTTP requests from a large number of distributed IP addresses. Which type of attack is this most likely to be?