212-89 Web Application Incidents Practice Test 3 — 15 Questions

Question 1

When responding to a SQL injection incident, which TWO areas of the database server logs should be prioritized for review?

Accepted Answer

Database user activity/audit logs. Option C (database user activity/audit logs) is correct because audit logs record authentication events, privilege changes, and the specific accounts and source hosts involved in suspicious activity, which is essential for identifying who executed the injection and what they accessed. Option E (database query execution logs) is correct because they capture the actual SQL statements sent to the server, allowing responders to spot injected payloads such as UNION SELECT, OR 1=1, or stacked queries and to determine which tables or data were touched. Together these two log sources provide the attacker identity and the malicious query evidence needed for containment and forensic reconstruction. Option A (OS kernel logs) is not prioritized because it deals with hardware, driver, and system-level events rather than SQL activity. Option B (backup completion logs) only shows whether backup jobs succeeded and has no bearing on detecting or tracing an injection. Option D (network interface statistics) provides traffic counters and throughput data, not the application-layer SQL content or user context required for this investigation.

Answer

Operating system kernel logs

Answer

Database backup completion logs

Answer

Network interface statistics

Question 2

Which THREE factors should be considered when tuning a WAF to reduce false positives for an application?

Accepted Answer

The specific needs and expected input patterns of the application. Option B is correct because effective WAF tuning must start from the application's own expected input patterns—legitimate parameter formats, file types, URL structures, and payload sizes—so that rules can be scoped to what the app actually receives rather than blocking benign traffic. Option D is correct because every exception or rule relaxation weakens protection, so the security team must weigh the reduced false-positive rate against the risk of allowing real attacks such as SQL injection or XSS through the newly opened gap. Option E is correct because tuning should be driven by the actual false-positive telemetry in the WAF logs—which rules fire, how often, and on which endpoints—so that high-noise rules are identified and adjusted based on evidence rather than guesswork. Option A is not a tuning factor because user volume affects capacity and rate-limiting decisions, not the accuracy of WAF rule matching, and Option C is irrelevant because server geography has no bearing on whether a request is a legitimate application input or a malicious payload.

Answer

The number of users accessing the site

Answer

The geographic location of the servers

Question 3

Which TWO log file attributes are essential for identifying the source of an attack coming through a load balancer?

Accepted Answer

X-Forwarded-For header. The X-Forwarded-For header (B) is essential because a load balancer typically terminates the client connection and proxies the request, so the web server's own logs would only show the load balancer's IP; X-Forwarded-For preserves the original client IP address needed to trace the attack source. The Original Request-URI (E) is also essential because it records exactly which resource or path the attacker requested, allowing correlation of the malicious request across the load balancer and backend server logs. Server uptime count (A) is irrelevant to attack attribution, as it only indicates how long the server has been running. Local time of the web server (C) is useful for correlating events but does not by itself identify the source of the attack. The load balancer's internal management port (D) is unrelated to client request tracing and would not reveal the attacker's origin.

Answer

Server uptime count

Answer

Local time of the web server

Answer

The load balancer's internal management port

Question 4

Which THREE items should be included in an incident report following a successful SQL injection attack?

Accepted Answer

A list of potentially affected data or databases. Option A is correct because an incident report must scope the breach by identifying which data or databases may have been exposed, enabling impact assessment and notification obligations. Option D is correct because documenting the specific attack vector and payload (for example, the vulnerable parameter and injected SQL syntax) is essential for root-cause analysis and for reproducing and validating the fix. Option E is correct because recording the remediation steps performed to close the vulnerability provides an auditable record of containment and eradication and supports verification that the flaw no longer exists. Option B does not belong because the discoverer's personal name is not a required technical or impact element of the report, and Option C does not belong because the data center's exact physical address is irrelevant to describing the SQL injection incident, its scope, or its remediation.

Answer

The personal name of the person who discovered the attack

Answer

The exact physical address of the data center

Question 5

During a web application incident, an analyst observes that an attacker is injecting malicious JavaScript into a comment field that is stored and later displayed to other users. Which type of web application incident is this?

Accepted Answer

Stored cross-site scripting (XSS). Stored XSS is identified when malicious script is saved by the application and later served to other users. The comment field acts as a persistent storage point, and the script executes in the browsers of anyone viewing the comment. This differs from reflected XSS, which is non-persistent, and from other injection types that target different components.

Answer

Reflected cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Question 6

A web application is experiencing an incident where an attacker is manipulating HTTP headers to bypass IP-based access controls. The attacker sets the X-Forwarded-For header to a trusted internal IP address. Which mitigation should an incident handler recommend to prevent this bypass?

Accepted Answer

Configure the web server to trust the X-Forwarded-For header only from known proxy servers.. The vulnerability arises because the web server trusts the X-Forwarded-For header from any source, allowing attackers to spoof it. The proper mitigation is to configure the server to accept this header only from known, trusted proxy servers. This ensures that the header is set by a legitimate intermediary and cannot be manipulated by external clients to bypass IP-based controls.

Answer

Disable the use of X-Forwarded-For entirely and rely on the source IP address of the TCP connection.

Answer

Implement a Web Application Firewall (WAF) rule to block all requests containing an X-Forwarded-For header.

Answer

Encrypt the X-Forwarded-For header using TLS to prevent tampering.

Question 7

While responding to a confirmed cross-site scripting (XSS) incident on a public web application, you need to determine whether the attacker exfiltrated session cookies. The application uses HTTPS and sets cookies without the HttpOnly flag. Which evidence source is MOST likely to reveal the stolen cookie values?

Accepted Answer

Outbound proxy or firewall logs showing requests to an attacker-controlled domain with cookie data in the URL. When an XSS payload reads a cookie that lacks the HttpOnly attribute and sends it to an external collector, the theft occurs over the network rather than in server-side application logs. Egress proxy or firewall logs capture the destination and full request URL, exposing the attacker-controlled endpoint and the encoded session token. This directly confirms exfiltration and supports containment actions such as blocking the collector domain and invalidating sessions.

Answer

The TLS certificate transparency log for the web application's domain

Answer

The database transaction log for the users table

Answer

The web server's access log entries showing HTTP 200 responses to /login

Question 8

An incident responder is investigating a web application breach and needs to determine the exact time an attacker uploaded a web shell. Which log source would most directly provide this information?

Accepted Answer

Web server access logs. Web server access logs are the most direct source because they capture the HTTP request that performed the upload, including the timestamp, source IP, and target URI. Other logs may provide supporting context but lack the specific detail needed to pinpoint the upload event. This makes access logs the primary resource for determining when a web shell was placed.

Answer

Database audit logs

Answer

Operating system security event logs

Answer

Firewall logs

Question 9

During an incident involving a compromised e-commerce web application, you need to determine whether an attacker used a stolen session cookie to access a user's account. Which HTTP header should you examine first in the web server access logs to identify the session token used in the malicious requests?

Accepted Answer

Cookie. The Cookie header is the only HTTP header that directly carries the session identifier used for authentication in cookie-based web applications. During a session hijacking investigation, correlating the Cookie value across requests allows you to confirm that an attacker used a stolen token. Other headers provide contextual information but lack the session token required to prove hijacking.

Answer

Referer

Answer

User-Agent

Answer

Authorization

Question 10

During an incident involving a compromised web application, you review an Apache access.log entry that shows a request for /admin/config.php with a response code of 200, but the request originated from an external IP address never seen before. The application is configured to require authentication for that path. Which incident response action is MOST appropriate to determine the scope of the compromise?

Accepted Answer

Correlate the external IP with authentication logs to verify whether a valid session or credential was used.. The key to scoping this incident is determining whether the external request to a protected path was authenticated. Correlating the source IP with authentication logs reveals if a valid session or credential was used, which indicates whether credentials were compromised or an authentication bypass occurred. This directly informs containment and remediation efforts.

Answer

Immediately block the external IP at the firewall and consider the incident contained.

Answer

Review the web server error logs for any 500 errors that occurred around the same time.

Answer

Check the file integrity of config.php to see if it was modified recently.

Question 11

An incident responder suspects a server-side request forgery (SSRF) incident against an internal web application that fetches remote images by URL. The application runs in a cloud VPC and can reach the instance metadata service. Which immediate containment action BEST reduces the risk of credential theft while preserving evidence?

Accepted Answer

Block outbound access from the application subnet to the instance metadata IP address 169.254.169.254 and capture the application's outbound traffic. Server-side request forgery that reaches the cloud instance metadata service can yield temporary credentials for the workload's IAM role. The most effective immediate containment is to deny the application's outbound access to the link-local metadata address while capturing traffic for analysis. This stops credential theft without destroying the instance, preserving memory, connections, and logs that are needed to determine whether any credentials were already used.

Answer

Enable verbose debug logging on the web application and wait for the next SSRF attempt

Answer

Immediately terminate the application instances and rebuild them from the base image

Answer

Rotate the TLS certificate used by the web application's public endpoint

Question 12

During a web application incident, an analyst discovers that an attacker is using SQL injection to extract data from a backend database. Which SQL injection technique involves the attacker inferring data by asking the database true/false questions and observing the application's response?

Accepted Answer

Blind SQL injection (boolean-based). Blind SQL injection (boolean-based) is characterized by the attacker asking the database true/false questions and observing changes in the application's behavior, such as different content or status codes. This technique is used when the application does not return direct query results or errors. The attacker can then systematically extract data by testing conditions.

Answer

Time-based SQL injection

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Question 13

A web application is experiencing an incident where attackers are injecting malicious JavaScript into stored user comments. The application reflects the input without proper sanitization. Which mitigation technique, when implemented correctly, is most effective at preventing this type of attack from executing in victims' browsers?

Accepted Answer

Context-aware output encoding. Context-aware output encoding is the most effective mitigation for XSS because it ensures that any user input is rendered as inert text in the appropriate context (HTML, attribute, JavaScript, etc.). This prevents the browser from executing injected scripts. While input validation and WAFs add layers of defense, they are not foolproof and do not address the root cause. HttpOnly protects cookies but not the XSS execution itself.

Answer

Web Application Firewall (WAF) signature blocking

Answer

Input validation using a allowlist of permitted characters

Answer

Setting the HttpOnly flag on session cookies

Question 14

A web application is behind a reverse proxy that forwards client requests. During an incident, you need to identify the true source IP of an attacker who is sending malicious requests. The web server logs show the IP of the reverse proxy instead of the client. Which HTTP header should you inspect in the web server logs to find the original client IP?

Accepted Answer

X-Forwarded-For. When a reverse proxy forwards requests, it typically adds the X-Forwarded-For header containing the original client IP. Web server logs must be configured to capture this header. Inspecting it allows incident responders to identify the true source IP of the attacker, which is essential for blocking, geolocation, and further investigation.

Answer

Host

Answer

User-Agent

Answer

Referer

Question 15

You are handling a confirmed incident in which an attacker uploaded a web shell named 'image_thumb.php' to a public-facing Apache server running PHP. The file is being invoked repeatedly via HTTP POST requests. Which action should you take FIRST to contain the threat while preserving forensic evidence?

Accepted Answer

Capture volatile data and a forensic copy of the web shell, then block its execution and network access to it while keeping the original in place.. Containment must balance stopping the attacker with preserving evidence. Capturing volatile data and a forensic copy of the web shell, then blocking its execution and external access, achieves both. Deleting the file, rebuilding the server, or relying solely on a WAF signature all sacrifice forensic value or leave the intrusion path open, undermining the subsequent eradication and recovery phases.

Answer

Immediately rebuild the server from a known-good image and restore the most recent backup.

Answer

Configure the WAF to block requests containing the string 'image_thumb.php' and continue monitoring.

Answer

Delete the web shell and restart the Apache service to break any active attacker sessions.