Investigating Web Attacks ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   After completing a web attack investigation, a forensic analyst must present findings to a non-technical executive board. Which reporting approach is most appropriate for this audience?

   • ARecommend immediate legal action without discussing the technical findings
   • BProvide a high-level summary of the attack's impact, timeline, and recommended remediation steps, with technical details in an appendix
   • CPresent the full technical report including raw log excerpts and memory dump analysis
   • DFocus only on the attacker's identity and motivation, omitting technical details
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of the executive summary in a forensic report on a web attack investigation?

   • ATo list all raw log entries in chronological order
   • BTo provide a step-by-step guide for reproducing the attack
   • CTo explain the technical details of the malware analysis
   • DTo provide a high-level overview of the investigation findings for non-technical stakeholders
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which network traffic characteristic is commonly used to identify a distributed denial-of-service (DDoS) attack in a packet capture?

   • AA single packet with a large payload
   • BA low number of packets from a single source
   • CA high volume of packets from many different source IP addresses
   • DEncrypted traffic on port 443
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A web application was defaced. You have the following evidence: (1) web server access logs show a successful POST to /upload.php from IP 203.0.113.5 at 02:15 UTC; (2) the uploaded file is a PHP script that creates a backdoor; (3) network captures show an outbound connection from the web server to 198.51.100.7:4444 at 02:20 UTC; (4) the defacement page was first seen at 02:25 UTC. Which conclusion is best supported by correlating these evidence sources?

   • AThe defacement was caused by a SQL injection attack that occurred before the upload
   • BThe attacker uploaded a backdoor, used it to connect to a command-and-control server, and then defaced the site
   • CThe outbound connection is unrelated to the defacement because it occurred after the upload
   • DThe defacement was performed by an insider with direct access to the server
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An attacker successfully exploited a web application. The web server logs show the following sequence: (1) a GET request to /search.php?q=<script>alert('x')</script>; (2) a POST to /login.php with a username containing SQL syntax; (3) a GET to /admin/users.php with a session cookie. Which attack methodology does this sequence best illustrate?

   • AReconnaissance, then exploitation, then privilege escalation
   • BDenial of service, then malware installation, then lateral movement
   • CPort scanning, then brute-force, then backdoor installation
   • DSocial engineering, then phishing, then data exfiltration
   Reveal Solution Discussion Select an answer first