Investigating Web Attacks ECSS Practice Questions (Page 11)

Questions 51–53

1. 51foundation · easy

   Which log file is most likely to contain records of failed login attempts that could indicate a brute-force attack on a web application?

   • AApplication logs
   • BFirewall logs
   • CDNS logs
   • DDHCP logs
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   You are investigating a web attack where the attacker used HTTPS. You have a packet capture from the server's network interface. Which evidence would be most useful to determine the attacker's actions?

   • AThe TLS certificate details
   • BThe server's TLS session keys, which can decrypt the HTTPS traffic
   • CThe server's access logs, which show the URLs requested
   • DThe client's IP address and port numbers
   Reveal Solution Discussion Select an answer first
3. 53foundation · easy

   In a network packet capture, which field is used to identify the destination service of an HTTP request?

   • ADestination port
   • BTCP sequence number
   • CIP identification field
   • DSource MAC address
   Reveal Solution Discussion Select an answer first