Web Application Forensics DFE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A web server log shows a request: `GET /download.php?file=../../../../etc/passwd HTTP/1.1` with a response of HTTP 200 and the content of `/etc/passwd` in the body. What does this indicate?

   • AA successful path traversal attack that allowed the attacker to read arbitrary files.
   • BA cross-site scripting (XSS) attack that stole the password file.
   • CA failed SQL injection attempt because the server returned the password file.
   • DA normal file download feature that allows users to download any file.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In a typical three-tier web application architecture, which component is responsible for executing business logic and coordinating data access?

   • AMiddleware
   • BDatabase
   • CClient
   • DApplication server
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of a Web Application Firewall (WAF) log?

   • ATo document blocked and allowed requests, including attack attempts
   • BTo record all user keystrokes on the web application
   • CTo provide a backup of the web server's configuration
   • DTo store the entire content of the database
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is reviewing HTTP traffic and sees the following request: `POST /search HTTP/1.1` `Host: example.com` `Content-Type: application/x-www-form-urlencoded` `Cookie: sessionid=abc123` `q=product%22%3E%3Cscript%3Ealert(1)%3C/script%3E` The response is HTTP 200 and contains the input reflected in the page. The WAF log shows no block for this request. What is the most likely vulnerability?

   • AReflected XSS, because the input is reflected in the response without sanitization.
   • BSQL injection, because the input contains quotes and angle brackets.
   • CPath traversal, because the input contains encoded characters.
   • DCSRF, because the request includes a session cookie.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A forensic analyst notices many requests to '/admin/login.php' from different IP addresses in a short time. Which pattern does this likely indicate?

   • AA brute-force attack
   • BA denial-of-service attack
   • CA SQL injection attempt
   • DNormal user behavior
   Reveal Solution Discussion Select an answer first