IIS and Apache Web Server Log Analysis DFE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An IIS log shows multiple requests to /search.aspx with query strings containing '<script>alert(1)</script>' and '%3Cscript%3E'. The requests return 200. Which attack is indicated, and which log field is most useful for identifying the payload?

   • ADirectory traversal; the cs-uri-query field contains encoded path sequences.
   • BCommand injection; the cs-uri-stem field contains system commands.
   • CCross-site scripting; the cs-uri-query field contains the script payloads.
   • DSQL injection; the cs-uri-stem field contains the SQL payloads.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You are reconstructing an attack timeline from IIS logs. The logs show: 1. `2024-09-01 00:00:00 10.0.0.1 GET /index.aspx 200` 2. `2024-09-01 00:00:01 10.0.0.1 GET /admin/login.aspx 200` 3. `2024-09-01 00:00:02 10.0.0.1 POST /admin/login.aspx 302` 4. `2024-09-01 00:00:03 10.0.0.1 GET /admin/upload.aspx 200` 5. `2024-09-01 00:00:04 10.0.0.1 POST /admin/upload.aspx 200` 6. `2024-09-01 00:00:05 10.0.0.1 GET /admin/shell.aspx 200` Which sequence of events is most consistent with this log?

   • AThe attacker browsed the site, logged in successfully, uploaded a file, and then accessed a web shell.
   • BThe attacker used SQL injection to bypass authentication and then uploaded malware.
   • CThe attacker performed a brute-force attack, then exploited a directory traversal vulnerability, and then executed commands.
   • DThe attacker accessed a publicly available admin page and then downloaded a file.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst is reconstructing the timeline of an attack from IIS logs. The logs show: 09:00:01 GET /login.aspx 200; 09:00:02 POST /login.aspx 302; 09:00:03 GET /admin/default.aspx 200; 09:00:04 GET /admin/users.aspx?delete=1 200; 09:00:05 GET /admin/logout.aspx 200. The analyst must determine whether the attacker gained access and what action was taken. Which conclusion is most accurate?

   • AThe attacker performed a SQL injection and then accessed the admin panel without logging in.
   • BThe attacker logged in successfully, accessed the admin panel, deleted a user, and then logged out.
   • CThe attacker accessed the admin panel but did not perform any administrative actions.
   • DThe attacker failed to log in and was redirected to a public page.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which log entry pattern is most characteristic of a directory traversal attack?

   • AGET /images/logo.png HTTP/1.1
   • BPOST /login.php HTTP/1.1
   • CGET /../../etc/passwd HTTP/1.1
   • DGET /index.php?page=home HTTP/1.1
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Given the IIS log entry: '2024-03-15 10:22:33 192.168.1.10 GET /login.aspx - 80 - 10.0.0.5 Mozilla/5.0 200 0 0 1234', what is the client IP address?

   • A1234
   • B80
   • C192.168.1.10
   • D10.0.0.5
   Reveal Solution Discussion Select an answer first