Handling and Responding to Web Application Security Incidents ECIH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An incident handler is collecting evidence from a compromised web application hosted on a cloud VM. The handler needs to preserve the evidence for potential legal action. Which action is MOST important to maintain the chain of custody?

   • ATake a screenshot of the VM console showing the current time and date.
   • BDocument who collected the evidence, when, and how, and use cryptographic hashes to verify integrity.
   • CDelete the VM immediately to prevent the attacker from accessing it again.
   • DCopy the VM's disk to a local drive using a standard file copy command.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A large online retailer uses a web application with a microservices architecture. The security team detects unusual outbound traffic from the application's payment processing service to an unknown external IP address. The application logs show that the payment service is making requests to a URL that is not part of the application's normal functionality. The team suspects a server-side request forgery (SSRF) vulnerability. The application is critical to business operations, and the team must balance immediate containment with continued service availability. Which of the following actions is the MOST appropriate initial response?

   • ADisable the payment service's ability to make any outbound requests until the vulnerability is patched.
   • BImmediately shut down the payment processing service to stop the outbound traffic and prevent data exfiltration.
   • CImplement a network firewall rule to block outbound traffic from the payment service to the unknown external IP address.
   • DIgnore the traffic for now and focus on identifying the root cause of the SSRF vulnerability.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of the final incident report in a web application security incident?

   • ATo satisfy the attacker's demands.
   • BTo assign blame to specific employees for the incident.
   • CTo provide a detailed account of the incident, response actions, and recommendations for improvement.
   • DTo advertise the organization's security capabilities to customers.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's e-commerce site is suddenly returning HTTP 500 errors on the product search page. The web server logs show a sharp spike in requests containing long strings of percent-encoded characters, and the application's memory usage has tripled. The incident handler suspects a web attack. What should the handler do FIRST to confirm the nature of the incident?

   • AReview the full request logs and correlate the pattern with WAF alerts to determine if this is a malicious payload or a legitimate scanning tool.
   • BRestore the application from the last known good backup and apply the latest security patches.
   • CBlock all traffic from the source IPs that generated the long percent-encoded requests.
   • DIsolate the web server from the network and begin forensic imaging of the disk.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services company's public-facing web application suddenly begins returning HTTP 500 errors for all requests. The operations team notices that the application's error logs are filling with SQL syntax errors referencing a 'UNION SELECT' statement, and the database server's CPU utilization has spiked to 100%. The application team confirms they did not deploy any code changes in the last 24 hours. What is the most appropriate immediate classification and response?

   • AClassify as a database performance issue, restart the database service, and monitor CPU utilization for the next hour before escalating.
   • BClassify as a denial-of-service attack, enable rate limiting on the web application firewall, and block the source IP addresses from the error logs.
   • CClassify as a web server misconfiguration, roll back to the last known good configuration, and reboot the web server.
   • DClassify as a likely SQL injection attack, isolate the application server from the database network segment, and begin collecting database and web server logs.
   Reveal Solution Discussion Select an answer first