During a web attack investigation, you have a packet capture from the perimeter firewall. You need to identify whether an attacker attempted SQL injection against the web application. Which network traffic pattern in the capture would be the strongest indicator?

A series of ICMP echo requests with increasing payload sizes

An HTTPS connection to the web server with a valid certificate and no unusual payloads

A single large POST request to the login page with a long password field

Multiple HTTP GET requests to the same URL with different numeric values in a query parameter, some containing single quotes and SQL keywords

Which section of a forensic report should include the chain of custody documentation for the evidence collected?

Evidence handling and preservation

A web server was compromised, and the attacker injected a malicious script into a web page. You have a memory dump of the server. Which memory artifact would be most useful to confirm the injection and identify the payload?

The web server process memory containing the injected script in the response buffer

The system event log entries for the web server service

The ARP cache of the server's network interface

The browser cache of a client that visited the page

A web application's search function is returning database error messages that include the full SQL query. An attacker has been observed submitting crafted input that causes the application to return data from the 'users' table. Which web attack vector is being exploited?

Cross-site request forgery (CSRF)

EC-CouncilCertified Security Specialist

Domain 6Objective 4

Investigating Web Attacks ECSS Practice Questions (Page 4)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

53questions here

11free pages

9concepts

Questions 16–20

16application · medium
During a web attack investigation, you have a packet capture from the perimeter firewall. You need to identify whether an attacker attempted SQL injection against the web application. Which network traffic pattern in the capture would be the strongest indicator?
Select an answer first
17foundation · easy
Which section of a forensic report should include the chain of custody documentation for the evidence collected?
Select an answer first
18foundation · easy
Which type of memory forensics artifact is most likely to contain a web shell that was injected into a running web server process?
Select an answer first
19application · medium
A web server was compromised, and the attacker injected a malicious script into a web page. You have a memory dump of the server. Which memory artifact would be most useful to confirm the injection and identify the payload?
Select an answer first
20application · medium
A web application's search function is returning database error messages that include the full SQL query. An attacker has been observed submitting crafted input that causes the application to return data from the 'users' table. Which web attack vector is being exploited?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.