IIS and Apache Web Server Log Analysis DFE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a typical field found in an IIS log entry that records the HTTP method used in the request?

   • Asc-status
   • Bcs-version
   • Ccs-method
   • Dcs(User-Agent)
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is reviewing Apache logs and notices a high number of requests with a 404 status, all from the same IP, with a user agent of 'python-requests/2.31'. The requests target random paths with names like /wp-login.php, /admin, and /test. What is the most likely explanation, and which command would confirm the pattern?

   • AThe IP is scanning for vulnerable paths; grep 'python-requests' access.log | awk '{print $1, $7, $9}' | sort | uniq -c | sort -nr
   • BThe IP is a legitimate crawler; grep 'python-requests' access.log | awk '{print $1, $4}' | sort | uniq -c
   • CThe IP is performing a brute-force attack; grep '404' access.log | awk '{print $1, $7}' | sort | uniq -c
   • DThe IP is launching a denial-of-service attack; grep 'python-requests' access.log | wc -l
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In an IIS log file using the W3C Extended Log Format, which field is used to record the IP address of the client that made the request?

   • As-ip
   • Bcs-host
   • Ccs-uri-stem
   • Dc-ip
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In an Apache Common Log Format (CLF) entry, which of the following fields is NOT present?

   • AUser-Agent string
   • BRemote host IP address
   • CRequest line
   • DHTTP status code
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When reconstructing the timeline of an attack from web server logs, what is the first step?

   • AGroup entries by IP address
   • BSort the log entries by timestamp in ascending order
   • CFilter out all 404 errors
   • DIdentify the user agent strings
   Reveal Solution Discussion Select an answer first