Handling and Responding to Web Application Security Incidents ECIH Practice Questions (Page 8)

Questions 36–39

1. 36application · medium

   After containing a web application incident, the incident response team has identified that the root cause was a SQL injection vulnerability in a search function. The vulnerable code has been patched, and the application has been restored from a clean backup. What is the NEXT critical step in the eradication and recovery phase?

   • ADelete all logs related to the incident to prevent the attacker from learning about the investigation.
   • BVerify that the application is functioning correctly and that the patch is effective by running a series of regression tests.
   • CNotify the public about the incident before the application is fully restored.
   • DImmediately return the application to production to minimize downtime and restore business operations.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   A web application firewall (WAF) logs show repeated SQL injection attempts against a login form, but the application is still responding normally. How should an incident handler classify this event?

   • AAs a false positive because the WAF is blocking all attempts.
   • BAs a denial-of-service incident because the attempts are overwhelming the WAF.
   • CAs a successful SQL injection attack because the WAF logged the attempts.
   • DAs a reconnaissance or attempted attack, not a confirmed incident, until evidence of success is found.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   Following a significant web application incident, the incident response team has completed the containment, eradication, and recovery phases. The team is now preparing the post-incident report. Which of the following elements is MOST critical to include in the report?

   • AA summary of the total financial cost of the incident, including lost revenue and recovery expenses.
   • BA detailed timeline of the incident, including when it was detected, contained, and eradicated.
   • CAn analysis of the root cause and a list of actionable recommendations to prevent similar incidents.
   • DThe names of all employees involved in the incident response effort.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security analyst notices that a web application's login page is returning unusually large responses, and the application logs show requests with long strings of encoded characters in the username field. The application is also experiencing intermittent crashes. Which type of web application attack is MOST likely occurring?

   • ADenial-of-service (DoS) attack, where the attacker is flooding the login page with requests to exhaust resources.
   • BSQL injection, where the attacker is attempting to manipulate database queries through the login form.
   • CCross-site scripting (XSS), where the attacker is injecting malicious scripts into the login page.
   • DBuffer overflow attack, where the attacker is sending more data than the application can handle, causing crashes.
   Reveal Solution Discussion Select an answer first