GSEC Log Management and SIEM Practice Question
A security analyst is reviewing logs from a Linux web server that has been compromised. The analyst notices a large number of requests to a specific URL that include encoded characters such as %27, %20, and %3D. The web server logs show these requests in the access log with a 200 OK response. Which type of attack is most likely indicated by these log entries?
⚠ Common exam trap
The trap here is assuming that any encoded characters in URLs indicate XSS or directory traversal, when the specific set of characters points to SQL injection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection
The encoded characters %27 (single quote), %20 (space), and %3D (equals) are commonly used in SQL injection attempts to manipulate SQL queries. The single quote is used to terminate strings, spaces separate SQL keywords, and equals signs are used in comparisons. The successful 200 OK responses suggest the application may be vulnerable. Other attack types would exhibit different patterns in the logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
XSS attacks typically involve injecting malicious scripts into web pages viewed by other users. While XSS payloads may include encoded characters, the presence of %27 (single quote), %20 (space), and %3D (equals) in a URL with successful responses is more indicative of SQL injection attempts. XSS would more commonly show script tags or JavaScript in the URL, not just these specific encoded characters.
- ✗
Directory traversal
Why it's wrong here
Directory traversal attacks use sequences like ../ or encoded variants (%2e%2e%2f) to access files outside the web root. The characters %27, %20, and %3D are not typical for directory traversal. They are more commonly associated with SQL injection. Directory traversal would show attempts to navigate file paths, not SQL syntax elements.
- ✗
Command injection
Why it's wrong here
Command injection involves injecting operating system commands via input fields. While encoded characters can appear, typical command injection payloads include semicolons (%3B), pipes (%7C), or backticks. The specific combination of %27, %20, and %3D is more characteristic of SQL injection. Command injection would more likely show attempts to execute commands like ls or cat, not just these encoded characters.
- ✓
SQL injection
Why this is correct
SQL injection attempts often use encoded characters like %27 (single quote) to break out of SQL queries, %20 (space) to separate keywords, and %3D (equals) for comparisons. The fact that the server returned 200 OK suggests the requests were successful, possibly indicating a vulnerable application. These encoded characters are classic indicators of SQL injection probing, especially when repeated in URL parameters.
About these practice questions
One of 351 original GSEC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.