Web Application Forensics DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A database log shows a sudden spike in queries from the application user, including `SELECT * FROM users` and `SELECT * FROM orders` in rapid succession, followed by a `DROP TABLE` command. The web server logs show a corresponding spike in requests to a search endpoint. What is the most likely scenario?

   • AA database administrator ran a routine maintenance script that accidentally dropped a table.
   • BThe database logs are corrupted and the queries are not real.
   • CAn attacker exploited SQL injection in the search endpoint to enumerate tables and then drop them.
   • DA misconfigured backup job caused the database to execute queries against the wrong schema.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A database log shows a series of SELECT statements that retrieve large amounts of data from a customer table, occurring outside normal business hours. What should an analyst suspect?

   • AA database software update
   • BA data exfiltration attempt
   • CA normal user session
   • DA routine backup process
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An analyst is reconstructing an attack timeline. The web server log shows a request to `POST /login` at 12:00:00. The WAF log shows the same request was blocked at 12:00:01. The database log shows a failed login attempt at 12:00:02. The analyst also sees a successful login at 12:00:05 from the same IP. What is the most likely sequence of events?

   • AThe attacker bypassed the WAF and the successful login is the result of the same attack.
   • BThe WAF blocked the initial attack, but the attacker used a different method to log in successfully at 12:00:05.
   • CThe WAF log is inaccurate because the database log shows a failed login, indicating the request reached the database.
   • DThe logs are inconsistent and cannot be used to reconstruct the timeline.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A WAF log shows a request to /admin.php that was blocked with a 403. The web server log shows no corresponding request. What does this indicate?

   • AThe web server log is incomplete and missing the request.
   • BThe request was cached by the WAF and never sent to the web server.
   • CThe web server processed the request but did not log it.
   • DThe WAF blocked the request before it reached the web server.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A WAF log entry shows a request that was blocked with a rule ID matching 'SQL injection'. What does this indicate?

   • AThe WAF detected a potential SQL injection attempt and blocked it
   • BThe WAF is malfunctioning
   • CThe request was successfully processed by the application
   • DThe database was compromised
   Reveal Solution Discussion Select an answer first