212-89 Web Application Incidents — Timed 20 Questions

Question 1

You are mitigating a Blind SQL Injection attack. What is the most effective server-side logging configuration change?

Accepted Answer

Disable all error reporting to the end user. Blind SQL injection relies on timing-based responses or differences in content length. Increasing log verbosity for query execution time helps identify these patterns.

Answer

Enable full packet capture on the database server

Answer

Enable verbose SQL query logging with execution timestamps

Answer

Increase the log rotation frequency

Question 2

You are auditing Apache logs to detect potential OS command injection. Which characters should you search for in the access logs?

Accepted Answer

';', '|', '&', and '`'. Characters like pipe, semicolon, and backticks are common metacharacters used to chain commands in OS command injection.

Answer

'%20', '+', and '='

Answer

'{', '}', and '$'

Answer

'<', '>', and '/'

Question 3

During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?

Accepted Answer

Create a granular exclusion for the specific parameter triggering the alert. Creating a targeted exception for a specific URI or parameter prevents over-blocking while keeping the signature active for the rest of the application.

Answer

Disable the entire XSS protection rule set

Answer

Implement a negative security model

Answer

Switch the WAF from Blocking mode to Transparent mode

Question 4

An attacker is using a slow-rate HTTP POST request to exhaust server resources. Which ModSecurity directive should be adjusted to mitigate this behavior?

Accepted Answer

SecRequestBodyLimit. ModSecurity's 'SecRequestBodyLimit' and 'SecRequestBodyNoFilesLimit' manage the size and rate of incoming request bodies.

Answer

SecDataDir

Answer

SecRuleEngine DetectionOnly

Answer

SecResponseBodyLimit

Question 5

An analyst is investigating a suspected SQL injection attack on an IIS server. Which log file should they prioritize to identify the specific URL-encoded payload strings submitted by the attacker?

Accepted Answer

W3C Extended Log File Format logs. W3C extended log files in IIS provide the most granular detail on URL parameters and query strings used in SQL injection.

Answer

Application Event logs

Answer

HTTPERR logs

Answer

Security Event logs

Question 6

A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?

Accepted Answer

Directory traversal or unauthorized access attempts are being blocked. Repeated 403 errors often indicate an attacker performing forced browsing or directory traversal attempts that are being blocked by server-side permission settings.

Answer

The user session has expired

Answer

The requested file does not exist

Answer

The server is offline

Question 7

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

Accepted Answer

A user session ID remains identical before and after a successful authentication event. Session fixation involves an attacker setting a victim's session ID before they log in. Observing the same session ID used by a guest and then by an authenticated user is the indicator.

Answer

High volume of requests to the login page without POST data

Answer

The same session ID is associated with two different IP addresses within a short timeframe

Answer

A sudden spike in failed login attempts

Question 8

Which HTTP header is most critical to inspect when identifying the origin of an attack passing through a reverse proxy?

Accepted Answer

X-Forwarded-For. The 'X-Forwarded-For' header allows the original client IP to be preserved through proxy/load balancer hops.

Answer

Referer

Answer

User-Agent

Answer

Host

Question 9

You are performing incident response on a web server compromised via Directory Traversal. What command is most useful for identifying the specific files accessed in the logs?

Accepted Answer

grep -r "../" /var/log/apache2/access.log. Using grep to search for traversal sequences like '../' within the access logs is the standard method for finding these attempts.

Answer

grep -r "SELECT" /var/log/apache2/access.log

Answer

grep -r "<script>" /var/log/apache2/access.log

Answer

tail -f /var/log/auth.log

Question 10

When analyzing an XSS attack, you find that the payload is being injected through a hidden form field. Which WAF policy is best suited to block this?

Accepted Answer

Implement strict field-level input validation for the specific hidden form parameter. WAFs with 'Input Validation' or 'Request Body Inspection' can be configured to enforce strict rules on specific form fields, including hidden ones.

Answer

Enable IP reputation blocking

Answer

Enable URL encoding normalization

Answer

Set the WAF to block all POST requests

Question 11

A user's session is hijacked. Which log attribute is most helpful in confirming the hijack occurred?

Accepted Answer

User-Agent string. Observing a change in the User-Agent string while the session ID remains constant is a strong indicator of session hijacking.

Answer

Request timestamp

Answer

Remote IP address

Answer

HTTP Referer

Question 12

An attacker is bypassing WAF signatures by using Unicode encoding. Which WAF feature must be enabled to normalize the traffic before inspection?

Accepted Answer

UTF-8/Unicode normalization. Unicode normalization ensures that multiple representations of the same character are converted to a standard format that signatures can recognize.

Answer

Content-Type header inspection

Answer

SSL/TLS offloading

Answer

Request body buffering

Question 13

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

Accepted Answer

Wireshark. Wireshark is the standard tool for capturing and analyzing raw network traffic, including the contents of HTTP packets.

Answer

Nmap

Answer

Netstat

Answer

Syslog

Question 14

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

Accepted Answer

Referer header showing a domain different from the application's domain. CSRF attacks originate from a different site. Checking the 'Referer' header in the logs for unexpected domains is the primary method for detection.

Answer

Multiple POST requests without a corresponding GET request

Answer

High volume of 401 Unauthorized errors

Answer

A sudden change in the session cookie value

Question 15

What is the primary function of a Web Application Firewall (WAF) in an incident response scenario?

Accepted Answer

Blocking known malicious patterns at the application layer. The primary function of a WAF during an incident is to provide real-time filtering and blocking of malicious HTTP traffic patterns.

Answer

Storing database backups

Answer

Encrypting all web traffic

Answer

Providing user authentication services

Question 16

A developer reports that a specific user is receiving 500 Internal Server Errors. Where is the first place to look to determine if this is an incident?

Accepted Answer

Error logs. The server's application error log contains the traceback and specific exception details for 500 errors, which often reveal if an attacker is triggering crashes.

Answer

Firewall logs

Answer

DNS logs

Answer

Access logs

Question 17

An attacker is using a specific User-Agent to scan your web application. How do you block them effectively?

Accepted Answer

Create a WAF rule to block requests with the specific User-Agent string. Creating a WAF rule to drop requests matching that specific User-Agent string is the most direct and efficient mitigation.

Answer

Disable all directory indexing on the server

Answer

Change the web server listening port

Answer

Update the server's hosts file

Question 18

What is the purpose of enabling 'Request Body Buffering' on a WAF during incident response?

Accepted Answer

To allow the WAF to inspect the full request body for malicious payloads. Buffering allows the WAF to receive the entire request before inspecting it, which is necessary to detect payloads that span across packets.

Answer

To compress incoming traffic

Answer

To improve web server performance

Answer

To hide the web server version from attackers

Question 19

Which THREE actions are essential when performing log review after a web application attack?

Accepted Answer

Correlate logs from the web server, WAF, and backend database. Log review requires correlation, integrity protection, and proper scope analysis.

Answer

Delete all log entries older than 24 hours to save space

Answer

Only review logs from the last hour of the incident

Question 20

You are reviewing logs after an incident. You see a sequence of requests starting with 'admin.php', then 'admin.php?id=1', then 'admin.php?id=1 OR 1=1'. What is the attacker doing?

Accepted Answer

Testing for SQL injection vulnerabilities. This sequence shows reconnaissance followed by an attempt to bypass authentication via SQL injection.

Answer

Executing a cross-site scripting attack

Answer

Performing a directory traversal

Answer

Performing a brute-force attack