IIS and Apache Web Server Log Analysis DFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A web administrator notices repeated 404 errors in the IIS log for a URL path that does not exist on the server. The log entries show the same client IP and a user agent of 'sqlmap/1.5'. Which IIS log field combination should the administrator examine to confirm the attack pattern and identify the target resource?

   • Acs-method, cs-version, and sc-bytes
   • Bcs-uri-stem, sc-status, and cs(User-Agent)
   • Cc-ip, s-ip, and time-taken
   • Ddate, time, and s-computername
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An analyst is investigating a possible web attack. The Apache logs show a high number of 404 errors from a single IP, but the user agent is a legitimate search engine crawler. The requests target paths like /admin, /backup, and /config. The analyst must decide whether to block the IP or investigate further. Which action is most appropriate?

   • ABlock the IP immediately because the request pattern is clearly malicious.
   • BInvestigate further because the user agent can be spoofed, and the request pattern is consistent with a scanner.
   • CIgnore the traffic because the user agent is a legitimate crawler.
   • DBlock the user agent string at the firewall to prevent future requests.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You are analyzing an IIS log and see the following entry: `2024-10-01 10:00:00 203.0.113.10 GET /default.aspx 404 Mozilla/5.0` What does the status code 404 indicate?

   • AThe request was redirected to another URL.
   • BThe requested resource was not found on the server.
   • CThe server encountered an internal error.
   • DThe client is not authorized to access the resource.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   You are parsing an IIS log entry and need to identify the HTTP method used. The entry is: `2024-11-01 09:00:00 192.0.2.5 PUT /api/upload 201 Mozilla/5.0` Which field is the HTTP method?

   • A201
   • BPUT
   • C/api/upload
   • D192.0.2.5
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is reviewing IIS logs and finds multiple requests to /login.aspx with query strings containing 'admin' OR '1'='1' and 'password' LIKE '%'. The requests originate from a single IP and return HTTP 200. Which attack is most likely, and which log fields provide the strongest evidence?

   • ACross-site scripting; the cs-uri-query field contains script tags and the sc-status shows successful responses.
   • BSQL injection; the cs-uri-query field contains SQL operators and the sc-status shows successful responses.
   • CDirectory traversal; the cs-uri-stem field contains path traversal sequences and the sc-status shows successful responses.
   • DBrute-force attack; the cs-uri-stem field shows repeated login attempts and the sc-status shows failed responses.
   Reveal Solution Discussion Select an answer first