CCNA Web Application Incidents Questions

You are performing incident response on a web server compromised via Directory Traversal. What command is most useful for identifying the specific files accessed in the logs?

Which THREE factors should be considered when tuning a WAF to reduce false positives for an application?

Which log file should you examine if you suspect an attacker is modifying the web server configuration files?

A user's session is hijacked. Which log attribute is most helpful in confirming the hijack occurred?

Which THREE components are typically involved in a web application's logging infrastructure that an incident responder should audit?

What is the primary function of a Web Application Firewall (WAF) in an incident response scenario?

An analyst is investigating a suspected SQL injection attack on an IIS server. Which log file should they prioritize to identify the specific URL-encoded payload strings submitted by the attacker?

A web server log shows repeated '403 Forbidden' errors for a specific directory. What is the most likely cause during an incident?

A web application's logs indicate an attacker successfully performed an XML External Entity (XXE) injection. What was likely the source of this vulnerability?

During a Cross-Site Scripting (XSS) incident, you notice the WAF is blocking legitimate user sessions. What is the most effective tuning step to prevent false positives while maintaining protection?

Which THREE actions are essential when performing log review after a web application attack?

Which TWO pieces of information must be collected to successfully track a session hijacking attack across multiple log sources?

You are auditing Apache logs to detect potential OS command injection. Which characters should you search for in the access logs?

A developer reports that a specific user is receiving 500 Internal Server Errors. Where is the first place to look to determine if this is an incident?

An attacker is using a specific User-Agent to scan your web application. How do you block them effectively?

A web application is vulnerable to session fixation. What is the primary indicator of this attack in the logs?

When responding to a SQL injection incident, which TWO areas of the database server logs should be prioritized for review?

Which TWO log file attributes are essential for identifying the source of an attack coming through a load balancer?

An attacker is using a slow-rate HTTP POST request to exhaust server resources. Which ModSecurity directive should be adjusted to mitigate this behavior?

Which THREE indicators in a web access log suggest a directory traversal attempt?

When analyzing an XSS attack, you find that the payload is being injected through a hidden form field. Which WAF policy is best suited to block this?

Which THREE items should be included in an incident report following a successful SQL injection attack?

An attacker is bypassing WAF signatures by using Unicode encoding. Which WAF feature must be enabled to normalize the traffic before inspection?

Which tool would you use to perform a live analysis of HTTP traffic and inspect for malicious payloads in real-time?

Which TWO settings in a WAF policy are most effective at mitigating automated bot-driven web attacks?

What is the purpose of enabling 'Request Body Buffering' on a WAF during incident response?

Which HTTP header is most critical to inspect when identifying the origin of an attack passing through a reverse proxy?

You suspect a CSRF (Cross-Site Request Forgery) attack. What log entry pattern confirms this?

You are reviewing logs after an incident. You see a sequence of requests starting with 'admin.php', then 'admin.php?id=1', then 'admin.php?id=1 OR 1=1'. What is the attacker doing?