Investigating Web Attacks ECSS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When analyzing web server logs, which log entry pattern is most indicative of a SQL injection attempt?

   • AA request for a favicon.ico file
   • BA request from a search engine crawler
   • CA request containing the string 'OR 1=1' in the query parameters
   • DA request with a normal-looking URL and a 200 status code
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An attacker is targeting a web application. The network captures show the following sequence: (1) a GET request to /robots.txt; (2) a GET request to /admin/login.php; (3) a POST to /admin/login.php with a username and password; (4) a GET to /admin/dashboard.php with a session cookie. Which attack methodology is most clearly demonstrated?

   • ADenial of service, then brute-force, then backdoor installation
   • BCross-site scripting, then session hijacking, then data theft
   • CSQL injection, then data exfiltration, then privilege escalation
   • DReconnaissance, then authentication bypass, then access to restricted functionality
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which step in the web attack methodology involves gathering information about the target without directly interacting with the target systems?

   • AScanning
   • BReconnaissance
   • CMaintaining access
   • DExploitation
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A web application firewall (WAF) blocked a series of requests to a customer portal. The WAF log shows repeated POST requests to /login with increasingly long 'username' parameters, some exceeding 1,000 characters. The application team reports no successful logins during that window. Which log-analysis step would best confirm whether the requests were a SQL injection attempt rather than a brute-force attack?

   • ACorrelate the WAF log timestamps with the application server's error log to check for SQL syntax errors in the database queries
   • BCheck the web server access log for the HTTP status codes returned for those POST requests
   • CCount the number of distinct source IP addresses in the WAF log to see if the requests came from a single host
   • DVerify whether the WAF rule that triggered was specifically a SQL injection signature rather than a rate-based rule
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a web attack investigation, you need to determine if the attacker accessed sensitive data from the database. Which evidence source would be most direct for this purpose?

   • ADatabase query logs showing SELECT statements with sensitive column names
   • BMemory dump of the web server
   • CWeb server access logs showing requests to the application
   • DNetwork packet capture of the database traffic
   Reveal Solution Discussion Select an answer first