212-89 Web Application Incidents Practice Test 2 — 15 Questions

Question 1

A developer reports that a specific user is receiving 500 Internal Server Errors. Where is the first place to look to determine if this is an incident?

Accepted Answer

Error logs. The server's application error log contains the traceback and specific exception details for 500 errors, which often reveal if an attacker is triggering crashes.

Answer

Firewall logs

Answer

DNS logs

Answer

Access logs

Question 2

An attacker is using a specific User-Agent to scan your web application. How do you block them effectively?

Accepted Answer

Create a WAF rule to block requests with the specific User-Agent string. Creating a WAF rule to drop requests matching that specific User-Agent string is the most direct and efficient mitigation.

Answer

Disable all directory indexing on the server

Answer

Change the web server listening port

Answer

Update the server's hosts file

Question 3

What is the purpose of enabling 'Request Body Buffering' on a WAF during incident response?

Accepted Answer

To allow the WAF to inspect the full request body for malicious payloads. Buffering allows the WAF to receive the entire request before inspecting it, which is necessary to detect payloads that span across packets.

Answer

To compress incoming traffic

Answer

To improve web server performance

Answer

To hide the web server version from attackers

Question 4

Which THREE actions are essential when performing log review after a web application attack?

Accepted Answer

Correlate logs from the web server, WAF, and backend database. Log review requires correlation, integrity protection, and proper scope analysis.

Answer

Delete all log entries older than 24 hours to save space

Answer

Only review logs from the last hour of the incident

Question 5

You are reviewing logs after an incident. You see a sequence of requests starting with 'admin.php', then 'admin.php?id=1', then 'admin.php?id=1 OR 1=1'. What is the attacker doing?

Accepted Answer

Testing for SQL injection vulnerabilities. This sequence shows reconnaissance followed by an attempt to bypass authentication via SQL injection.

Answer

Executing a cross-site scripting attack

Answer

Performing a directory traversal

Answer

Performing a brute-force attack

Question 6

A web application's logs indicate an attacker successfully performed an XML External Entity (XXE) injection. What was likely the source of this vulnerability?

Accepted Answer

Insecure configuration of the XML parser. XXE occurs when an XML parser is configured to resolve external entities, allowing access to local files.

Answer

Lack of CSRF tokens in POST requests

Answer

SQL injection in a login form

Answer

Missing input sanitization in a search field

Question 7

Which log file should you examine if you suspect an attacker is modifying the web server configuration files?

Accepted Answer

Audit logs (e.g., /var/log/audit/audit.log). System-level audit logs like 'auditd' or file integrity monitoring logs track changes to sensitive configuration files.

Answer

Application error logs

Answer

Web server status logs

Answer

Access logs

Question 8

Which TWO settings in a WAF policy are most effective at mitigating automated bot-driven web attacks?

Accepted Answer

Implementation of a CAPTCHA challenge. Rate limiting and challenge-response mechanisms (like CAPTCHA) are the most effective controls for blocking automated bots.

Answer

Enabling verbose debugging mode

Answer

Disabling all HTTP POST requests

Answer

Reducing the global connection timeout

Question 9

Which THREE components are typically involved in a web application's logging infrastructure that an incident responder should audit?

Accepted Answer

Web server access and error logs. A complete audit requires reviewing the web server, the security layer (WAF), and the application itself.

Answer

Printer spooler logs

Answer

Hardware router logs

Question 10

Which TWO pieces of information must be collected to successfully track a session hijacking attack across multiple log sources?

Accepted Answer

The session ID/cookie value. Linking sessions across logs requires a common identifier like a session cookie or ID and the associated timestamp.

Answer

The BIOS version of the server

Answer

The web server's MAC address

Answer

The server's physical location

Question 11

Which THREE indicators in a web access log suggest a directory traversal attempt?

Accepted Answer

Repeated access to sensitive files like 'passwd' or 'config.php'. Traversal attempts use specific patterns to move outside the intended root directory.

Answer

Requests for CSS files

Answer

High number of image file requests

Question 12

When responding to a SQL injection incident, which TWO areas of the database server logs should be prioritized for review?

Accepted Answer

Database user activity/audit logs. Database logs and audit logs provide the necessary visibility into query execution and unauthorized access.

Answer

Operating system kernel logs

Answer

Database backup completion logs

Answer

Network interface statistics

Question 13

Which THREE factors should be considered when tuning a WAF to reduce false positives for an application?

Accepted Answer

The specific needs and expected input patterns of the application. Tuning must balance security requirements, application behavior, and maintenance of the rule set.

Answer

The number of users accessing the site

Answer

The geographic location of the servers

Question 14

Which TWO log file attributes are essential for identifying the source of an attack coming through a load balancer?

Accepted Answer

X-Forwarded-For header. Since a load balancer sits between the client and the server, preserving the client's IP and original request path is critical.

Answer

Server uptime count

Answer

Local time of the web server

Answer

The load balancer's internal management port

Question 15

Which THREE items should be included in an incident report following a successful SQL injection attack?

Accepted Answer

A list of potentially affected data or databases. An incident report needs to document what happened, the scope of the impact, and the remediation steps taken.

Answer

The personal name of the person who discovered the attack

Answer

The exact physical address of the data center