Handling and Responding to Web Application Security Incidents ECIH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An incident handler is collecting evidence from a compromised web server and needs to ensure the evidence is admissible in court. Which of the following actions is MOST important to maintain the chain of custody?

   • ADocumenting every person who handled the evidence and when, along with a secure storage location.
   • BStoring the evidence on the same server where the incident occurred to avoid moving it.
   • CMaking multiple copies of the evidence and distributing them to different team members for analysis.
   • DEncrypting the evidence files to prevent unauthorized access during transport.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   During routine monitoring, a security analyst notices a series of HTTP 500 errors in the web server logs, followed by a spike in outbound traffic from the web server to an external IP address. Which symptom is most indicative of a web application security incident?

   • AThe HTTP 500 errors indicate a misconfiguration, not a security incident.
   • BThe HTTP 500 errors alone are sufficient to classify this as a denial-of-service incident.
   • CThe spike in outbound traffic to an external IP suggests data exfiltration or command-and-control activity.
   • DThe external IP address is likely a legitimate third-party API, so no incident is occurring.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A web application is under an active SQL injection attack. Which containment measure is most appropriate to immediately limit the attack's impact?

   • AChange the database password.
   • BReboot the web server to clear the attack.
   • CDisconnect the web server from the network.
   • DApply a WAF rule to block the malicious SQL injection patterns.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An incident handler needs to collect evidence from a compromised web server. Which action is most consistent with forensic soundness?

   • ACopy only the log files to a network share.
   • BUse the server's own tools to copy files to a USB drive.
   • CCreate a bit-for-bit image of the server's storage using a write-blocker.
   • DRun a virus scan on the server to confirm the infection.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a web application incident, an incident handler needs to collect evidence from a Linux web server. The server is still running, and the incident handler wants to preserve volatile data before shutting down the server. Which of the following actions should be performed FIRST?

   • ACreate a bit-for-bit copy of the hard drive using a forensic imaging tool.
   • BDisconnect the server from the network and then begin collecting log files.
   • CCapture the contents of memory using a tool like 'dd' or 'memdump'.
   • DRun 'netstat -an' to record active network connections and then immediately power off the server.
   Reveal Solution Discussion Select an answer first