212-89 Web Application Incidents Practice Test 2 — 15 Questions

Question 1

An attacker is bypassing WAF signatures by using Unicode encoding. Which WAF feature must be enabled to normalize the traffic before inspection?

Accepted Answer

UTF-8/Unicode normalization. Unicode encoding allows attackers to represent characters in multiple ways (e.g., using full-width characters or overlong UTF-8 sequences) to bypass signature-based WAF rules that look for literal ASCII patterns. Enabling UTF-8/Unicode normalization forces the WAF to convert all input into a canonical form before matching signatures, so obfuscated payloads are decoded and inspected correctly. Without normalization, the WAF sees encoded gibberish and misses the attack.

Answer

Content-Type header inspection

Answer

SSL/TLS offloading

Answer

Request body buffering

Question 2

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

Accepted Answer

Wireshark. Wireshark is a protocol analyzer that captures and decodes live network traffic, allowing real-time inspection of HTTP requests and responses, including payload contents, headers, and body data. It can reassemble TCP streams and apply display filters (e.g., http.request) to isolate malicious payloads as they traverse the wire. This makes it the correct tool for live HTTP traffic analysis.

Answer

Nmap

Answer

Netstat

Answer

Syslog

Question 3

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

Accepted Answer

Referer header showing a domain different from the application's domain. CSRF attacks originate from a different site. Checking the 'Referer' header in the logs for unexpected domains is the primary method for detection.

Answer

Multiple POST requests without a corresponding GET request

Answer

High volume of 401 Unauthorized errors

Answer

A sudden change in the session cookie value

Question 4

What is the primary function of a Web Application Firewall (WAF) in an incident response scenario?

Accepted Answer

Blocking known malicious patterns at the application layer. A WAF inspects HTTP/HTTPS traffic at the application layer (Layer 7) and blocks requests matching known malicious patterns such as SQLi, XSS, and command injection signatures. In incident response, it serves as a containment control that can immediately block ongoing attack traffic while the team investigates. This makes it a key tool for rapid mitigation.

Answer

Storing database backups

Answer

Encrypting all web traffic

Answer

Providing user authentication services

Question 5

A developer reports that a specific user is receiving 500 Internal Server Errors. Where is the first place to look to determine if this is an incident?

Accepted Answer

Error logs. Error logs on the web server or application record 500 Internal Server Error events with stack traces, exception messages, and timestamps, making them the first place to determine whether the error is a benign bug or a sign of an incident (e.g., injection, resource exhaustion).

Answer

Firewall logs

Answer

DNS logs

Answer

Access logs

Question 6

An attacker is using a specific User-Agent to scan your web application. How do you block them effectively?

Accepted Answer

Create a WAF rule to block requests with the specific User-Agent string. A WAF rule that matches the specific User-Agent string and blocks matching requests is the most direct and effective control, because it targets the exact signature the attacker is using. WAFs like AWS WAF, Cloudflare, or ModSecurity can match on the User-Agent header via string-match or regex conditions and return a 403 before the request reaches the origin. This stops the scanner without affecting legitimate traffic that uses different User-Agents.

Answer

Disable all directory indexing on the server

Answer

Change the web server listening port

Answer

Update the server's hosts file

Question 7

What is the purpose of enabling 'Request Body Buffering' on a WAF during incident response?

Accepted Answer

To allow the WAF to inspect the full request body for malicious payloads. Request Body Buffering forces the WAF to buffer the entire HTTP request body before forwarding it to the backend, which is essential because many WAF inspection engines can only analyze the full payload once it has been completely received. Without buffering, the WAF may only inspect headers or the first chunk of a chunked/streamed body, allowing attackers to smuggle malicious payloads past inspection. During incident response, enabling this ensures payloads like SQLi, XSS, or file-upload exploits embedded deep in the body are actually evaluated against WAF rules.

Answer

To compress incoming traffic

Answer

To improve web server performance

Answer

To hide the web server version from attackers

Question 8

Which THREE actions are essential when performing log review after a web application attack?

Accepted Answer

Correlate logs from the web server, WAF, and backend database. Option B is correct because correlating logs from the web server, WAF, and backend database provides a complete timeline of the attack, linking the initial HTTP request, the WAF's detection or bypass, and any resulting database queries or errors. Option D is correct because verifying log integrity with checksums (e.g., SHA-256 hashes) ensures that attackers have not altered or deleted evidence, which is critical for a trustworthy forensic review. Option E is correct because searching logs for known attack signatures such as SQL injection patterns (e.g., ' OR 1=1--), cross-site scripting payloads, or path traversal sequences helps identify the specific exploitation attempts and affected endpoints. Option A is incorrect because deleting logs destroys evidence and violates retention requirements; logs should be preserved and archived, not purged. Option C is incorrect because limiting review to only the last hour of the incident misses the initial reconnaissance, exploitation, and persistence phases, which may have occurred earlier.

Answer

Delete all log entries older than 24 hours to save space

Answer

Only review logs from the last hour of the incident

Question 9

You are reviewing logs after an incident. You see a sequence of requests starting with 'admin.php', then 'admin.php?id=1', then 'admin.php?id=1 OR 1=1'. What is the attacker doing?

Accepted Answer

Testing for SQL injection vulnerabilities. The progression from 'admin.php' to 'admin.php?id=1' to 'admin.php?id=1 OR 1=1' shows the attacker probing a parameter and then injecting a classic SQL tautology ('OR 1=1') to bypass authentication or extract data. This is textbook SQL injection testing.

Answer

Executing a cross-site scripting attack

Answer

Performing a directory traversal

Answer

Performing a brute-force attack

Question 10

A web application's logs indicate an attacker successfully performed an XML External Entity (XXE) injection. What was likely the source of this vulnerability?

Accepted Answer

Insecure configuration of the XML parser. XXE injection occurs when an application parses XML input with a parser that has external entity resolution enabled. This allows an attacker to define custom entities that reference external resources (e.g., local files or remote URLs), leading to data disclosure, SSRF, or denial of service. The root cause is an insecure configuration of the XML parser, such as not disabling DTDs or external entities. Therefore, option C correctly identifies the source of the vulnerability.

Answer

Lack of CSRF tokens in POST requests

Answer

SQL injection in a login form

Answer

Missing input sanitization in a search field

Question 11

Which log file should you examine if you suspect an attacker is modifying the web server configuration files?

Accepted Answer

Audit logs (e.g., /var/log/audit/audit.log). Audit logs (e.g., /var/log/audit/audit.log) are the correct source because they capture system-level events including file modifications, permission changes, and access to critical configuration files via the Linux Audit subsystem. When an attacker tampers with web server configuration files such as httpd.conf or nginx.conf, the audit daemon (auditd) records the write, rename, or attribute-change syscalls against those file paths. This makes audit logs the authoritative record for detecting configuration tampering, unlike application-layer logs that only reflect the web server's own runtime behavior.

Answer

Application error logs

Answer

Web server status logs

Answer

Access logs

Question 12

Which TWO settings in a WAF policy are most effective at mitigating automated bot-driven web attacks?

Accepted Answer

Implementation of a CAPTCHA challenge. Option B (Implementation of a CAPTCHA challenge) is correct because CAPTCHAs are designed to distinguish human users from automated scripts, forcing bots to solve a challenge they typically cannot complete, thereby blocking automated bot-driven attacks at the application layer. Option D (Rate limiting based on IP address) is correct because throttling the number of requests a single IP can make within a time window directly mitigates the high-volume, repetitive request patterns characteristic of bot-driven attacks such as credential stuffing or scraping. Option A (Enabling verbose debugging mode) is incorrect because debugging output exposes internal details and does not mitigate bot traffic; it may actually aid attackers. Option C (Disabling all HTTP POST requests) is incorrect because it is overly broad and would break legitimate application functionality rather than selectively targeting bots. Option E (Reducing the global connection timeout) is incorrect because shortening timeouts does not distinguish bots from users and can degrade legitimate user experience without meaningfully stopping automated attacks.

Answer

Enabling verbose debugging mode

Answer

Disabling all HTTP POST requests

Answer

Reducing the global connection timeout

Question 13

Which THREE components are typically involved in a web application's logging infrastructure that an incident responder should audit?

Accepted Answer

Web server access and error logs. Option A (Web server access and error logs) is correct because these logs record every HTTP request, response code, source IP, and server-side errors, which are essential for reconstructing how an attacker interacted with the web application. Option B (WAF audit logs) is correct because a Web Application Firewall logs blocked, allowed, and flagged requests, revealing attempted exploits such as SQL injection or XSS that may not appear in normal server logs. Option D (Application-level audit logs) is correct because they capture business-logic events like authentication, authorization changes, and user actions, providing the internal context that infrastructure logs lack. Option C (Printer spooler logs) is not relevant since print services are unrelated to web application request handling or attack surfaces. Option E (Hardware router logs) is not part of the web application's logging infrastructure, as routers operate at the network layer and do not record application-level activity.

Answer

Printer spooler logs

Answer

Hardware router logs

Question 14

Which TWO pieces of information must be collected to successfully track a session hijacking attack across multiple log sources?

Accepted Answer

The session ID/cookie value. To track a session hijacking attack across multiple log sources, you must be able to correlate the attacker's activity with the victim's session, which requires the session ID/cookie value (option B) because that token uniquely identifies the HTTP session and appears in web server, proxy, and application logs. You also need the exact timestamp of the requests (option E) so that events recorded in different logs (e.g., web server access logs, firewall logs, IDS/IPS alerts) can be aligned chronologically to reconstruct the attack sequence. The BIOS version of the server (option A) is irrelevant to session tracking because it does not identify user sessions or request timing. The web server's MAC address (option C) is a layer-2 hardware identifier that does not appear in application-layer session logs and cannot correlate a hijacked session. The server's physical location (option D) is also irrelevant, as session hijacking is tracked through logical identifiers and timestamps, not geographic placement of hardware.

Answer

The BIOS version of the server

Answer

The web server's MAC address

Answer

The server's physical location

Question 15

Which THREE indicators in a web access log suggest a directory traversal attempt?

Accepted Answer

Repeated access to sensitive files like 'passwd' or 'config.php'. Option A is correct because directory traversal attacks aim to reach files outside the web root, so repeated requests for sensitive files such as 'passwd' (e.g., /etc/passwd) or 'config.php' in the access log strongly indicate an attempt to read protected system or application files. Option B is correct because URL parameters containing system file paths (e.g., ?file=/etc/passwd or ?page=C:\Windows\win.ini) show an attacker trying to supply an absolute path to force the application to disclose a local file. Option C is correct because the '../' sequence (dot-dot-slash) is the canonical traversal payload used to climb out of the web directory, and its presence in a requested URL is a direct signature of path traversal. Option D is not correct because requests for CSS files are normal static-resource traffic and do not by themselves indicate traversal. Option E is not correct because a high number of image file requests is typical of legitimate page rendering or caching and is not a traversal indicator.

Answer

Requests for CSS files

Answer

High number of image file requests