IIS and Apache Web Server Log Analysis DFE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which command-line tool is commonly used to filter lines from a log file that contain a specific pattern, such as 'error'?

   • Ased
   • Bgrep
   • Ccut
   • Dawk
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which HTTP status code would you expect to see in a log for a request that was forbidden due to insufficient permissions?

   • A500
   • B403
   • C404
   • D200
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst is reviewing IIS logs and sees a sequence of requests: a POST to /login.aspx returning 302, then a GET to /admin/default.aspx returning 200, then a POST to /admin/delete.aspx?id=5 returning 200. What does this sequence indicate?

   • AThe user attempted a SQL injection and the server returned an error.
   • BThe user was blocked by the server and then accessed a public page.
   • CThe user authenticated successfully and then performed an administrative action.
   • DThe user failed to authenticate and was redirected to a public page.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   While reviewing the IIS logs for a public-facing web server, you notice the following entry: `2024-05-14 03:22:11 10.0.0.5 GET /product.aspx?id=1%27%20OR%20%271%27%3D%271 500 - Mozilla/5.0`. The server returned a 500 status. Which type of attack does this entry most likely indicate?

   • ADirectory traversal attempt
   • BBrute-force login attempt
   • CCross-site scripting (XSS) attempt
   • DSQL injection attempt
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A web server was compromised. The IIS logs show the following entries (oldest to newest): 1. `2024-06-01 10:00:00 192.168.1.10 GET /login.aspx 200` 2. `2024-06-01 10:00:05 192.168.1.10 POST /login.aspx 302` 3. `2024-06-01 10:00:10 192.168.1.10 GET /admin/upload.aspx 200` 4. `2024-06-01 10:00:15 192.168.1.10 POST /admin/upload.aspx 200` 5. `2024-06-01 10:00:20 192.168.1.10 GET /shell.aspx 200` Which sequence best describes the attack timeline?

   • AFailed login, then directory traversal, then file upload, then command execution
   • BSQL injection, then data exfiltration, then malware installation
   • CBrute-force login, then privilege escalation, then file upload, then backdoor access
   • DSuccessful login, then file upload, then execution of a web shell
   Reveal Solution Discussion Select an answer first