An IIS log entry reads: 2023-10-05 08:12:33 192.168.2.50 GET /scripts/..%5c..%5cwinnt/system32/cmd.exe - 404 0 0 1234 5678. Which attack is indicated, and which fields confirm it?

Cross-site scripting; the cs-uri-stem contains a script tag and the sc-status is 404.

Denial of service; the cs-uri-stem shows a high request rate and the sc-status is 404.

SQL injection; the cs-uri-stem contains a database query and the sc-status is 404.

Directory traversal; the cs-uri-stem contains encoded traversal sequences and a system executable path.

EC-CouncilDigital Forensics Essentials

Domain 5Objective 5

IIS and Apache Web Server Log Analysis DFE Practice Questions (Page 9)

Part of the Network and Web Attack Forensics domain, which makes up ~15% of our current practice bank.

42questions here

9free pages

8concepts

Questions 41–42

41application · medium
An IIS log entry reads: 2023-10-05 08:12:33 192.168.2.50 GET /scripts/..%5c..%5cwinnt/system32/cmd.exe - 404 0 0 1234 5678. Which attack is indicated, and which fields confirm it?
Select an answer first
42application · medium
You are examining an IIS log file and see the following entry: `2024-07-01 12:00:00 203.0.113.5 GET /index.html 200 Mozilla/5.0` Which field is missing from this entry compared to a standard IIS W3C log entry?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

IIS and Apache Web Server Log Analysis DFE Practice Questions (Page 9)

Questions 41–42

An IIS log entry reads: 2023-10-05 08:12:33 192.168.2.50 GET /scripts/..%5c..%5cwinnt/system32/cmd.exe - 404 0 0 1234 5678. Which attack is indicated, and which fields confirm it?

You are examining an IIS log file and see the following entry: `2024-07-01 12:00:00 203.0.113.5 GET /index.html 200 Mozilla/5.0` Which field is missing from this entry compared to a standard IIS W3C log entry?

Keep studying — Network and Web Attack Forensics