IIS and Apache Web Server Log Analysis DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An IIS log entry shows: 2023-10-05 14:22:10 10.0.0.5 GET /search.aspx?q=<script>alert(1)</script> - 200 0 0 1234 5678. Which fields confirm a cross-site scripting attempt, and what does the 200 status indicate?

   • Acs-uri-query contains the script payload, and sc-status 200 indicates the server processed the request, potentially reflecting the payload.
   • Bcs-uri-stem contains the script payload, and sc-status 200 indicates the request was blocked.
   • Ccs-method contains the script payload, and sc-status 200 indicates a directory traversal attempt.
   • Dcs(User-Agent) contains the script payload, and sc-status 200 indicates a successful SQL injection.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In the Apache log entry: '192.168.1.10 - - [15/Mar/2024:10:22:33 +0000] "GET /index.html HTTP/1.1" 200 1024', what does '1024' represent?

   • AThe size of the response in bytes
   • BThe request time in milliseconds
   • CThe client's port number
   • DThe HTTP status code
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An analyst is investigating a potential web attack. The Apache logs show a series of requests from the same IP to `/search.php?q=<script>alert(1)</script>` with a 200 status code. Which attack is indicated?

   • ASQL injection
   • BCross-site scripting (XSS)
   • CCommand injection
   • DDirectory traversal
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is reviewing IIS logs and sees a high number of requests returning a 403 status code for a specific directory. What does this pattern most likely indicate?

   • AA brute-force attack on a login page
   • BA distributed denial-of-service (DDoS) attack
   • CA successful SQL injection attack
   • DA misconfigured access control list (ACL) or permission issue
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is reconstructing an attack timeline from Apache logs. The logs show: a 404 for /admin, then a 200 for /admin/login.php, then a 302 for /admin/index.php, then a 200 for /admin/users.php?delete=1. What is the most likely sequence of events?

   • AThe attacker launched a brute-force attack, failed, and then used a SQL injection to gain access.
   • BThe attacker probed for an admin panel, found the login page, logged in successfully, and then accessed a user management page to delete a user.
   • CThe attacker attempted a directory traversal, was blocked, and then accessed the admin panel directly.
   • DThe attacker exploited a cross-site scripting vulnerability and then performed a privilege escalation.
   Reveal Solution Discussion Select an answer first