Web Application Forensics DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A web server log shows the following request: `GET /product.php?id=1%20AND%201=1-- HTTP/1.1`. The response was HTTP 200 with a page containing product details. The analyst also sees a subsequent request: `GET /product.php?id=1%20AND%201=2-- HTTP/1.1` which returned HTTP 200 but with a different page layout. Which conclusion is best supported by these observations?

   • AThe server is vulnerable to XSS because the injected script executed and changed the page layout.
   • BThe application is protected by a WAF that blocked the second request, causing the layout change.
   • CThe application is vulnerable to SQL injection because the responses differ between the two boolean conditions.
   • DThe requests are normal URL-encoded parameters and do not indicate any attack.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst needs to reconstruct a web attack timeline from multiple sources: web server logs, WAF logs, database logs, and packet captures. The analyst has limited time and must prioritize which evidence to analyze first. Which approach is most effective?

   • AAnalyze only the web server logs because they contain all requests and responses.
   • BCorrelate timestamps across all log sources to build a unified timeline, starting with the WAF logs to identify initial attack attempts.
   • CStart with packet captures because they contain the raw data and are the most reliable source.
   • DUse database logs exclusively because they show the final impact of the attack.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A web application has a WAF that blocks requests containing `' OR '1'='1`. An attacker sends the following request to `POST /login`: `username=admin' OR '1'='1' --&password=x`. The WAF blocks it. The attacker then sends: `username=admin%27%20OR%20%271%27%3D%271%27%20--&password=x`. The WAF allows it, and the login succeeds. What is the most effective remediation?

   • AUpgrade the web server to the latest version.
   • BConfigure the WAF to decode URL-encoded payloads before applying rules.
   • CBlock all requests with the `username` parameter containing the word 'admin'.
   • DDisable the WAF and rely on input validation in the application.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which web vulnerability allows an attacker to inject malicious SQL code into a query, potentially reading or modifying database contents?

   • ACross-site scripting (XSS)
   • BSQL injection
   • CCross-site request forgery (CSRF)
   • DFile inclusion
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A forensic analyst is investigating a breach of a web application. The application uses a three-tier architecture: a web server, an application server, and a database server. The analyst has access to logs from all three tiers. Which log source is most likely to reveal the initial attack vector?

   • ADatabase logs, because they show the final data access.
   • BApplication server logs, because they show business logic execution.
   • CMiddleware logs, because they show communication between tiers.
   • DWeb server logs, because they record the initial HTTP requests from clients.
   Reveal Solution Discussion Select an answer first