Web Application Forensics DFE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A WAF log shows a request to `POST /comment` with body `comment=<script>alert('XSS')</script>`. The WAF blocked the request. However, the web server log shows a similar request with the script encoded as `%3Cscript%3Ealert('XSS')%3C/script%3E` that was not blocked and returned HTTP 200. What does this indicate?

   • AThe WAF can be bypassed with URL encoding, allowing XSS payloads to reach the application.
   • BThe web server log is from a different server that does not have a WAF.
   • CThe WAF blocked the first request, so the second request is a false positive.
   • DThe application is safe because the WAF blocked the first attempt.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst reviews WAF logs and finds a request to /search.php?q=<script>alert('xss')</script> that returned HTTP 200. The web server log shows the same request also returned 200. What does this indicate?

   • AThe WAF did not block the request, and the application may have reflected the script to users.
   • BThe WAF logged the request but forwarded it to the application for further analysis.
   • CThe request was a false positive, and the WAF correctly allowed a benign search.
   • DThe WAF blocked the request, but the web server still logged it as 200.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company's WAF is configured to block requests containing the string '/etc/passwd'. An analyst sees a WAF log entry for a request to /download.php?file=....//....//etc/passwd that was blocked. However, the web server log shows a 200 response for the same request. What is the most likely explanation?

   • AThe web server log is incorrect because it logs requests before the WAF processes them.
   • BThe WAF rule was bypassed because the payload used encoding or obfuscation that the WAF did not normalize.
   • CThe WAF blocked the request, but the web server still processed it because the WAF is in monitoring mode.
   • DThe WAF blocked the request, but the web server log entry is from a different request with the same URL.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which vulnerability occurs when an application includes a file based on user-controlled input, potentially allowing an attacker to read sensitive files or execute remote code?

   • AFile inclusion
   • BSQL injection
   • CCross-site scripting (XSS)
   • DCross-site request forgery (CSRF)
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   An analyst needs to collect evidence from a compromised web server. The server is running Linux with Apache and MySQL. The analyst must preserve evidence in a forensically sound manner. Which of the following actions should be performed FIRST?

   • AShut down the server immediately to prevent further damage.
   • BRun a live analysis to identify running processes and network connections.
   • CCopy the Apache access logs to a USB drive.
   • DCreate a bit-for-bit image of the server's hard drive before any analysis.
   Reveal Solution Discussion Select an answer first