Investigating Web Attacks ECSS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium · select all that apply

   A web server was compromised via a file upload vulnerability. Which of the following are potential sources of digital evidence for this attack? (Select all that apply.)

   • AWeb server access logs showing the upload request
   • BNetwork traffic capture showing the file transfer
   • CMemory dump of the web server process
   • DDatabase logs showing queries after the upload
   • EThe attacker's social media profile
   Check answers Discussion Select an answer first
2. 37foundation · easy

   Which volatile memory artifact is essential for identifying active network connections established by a compromised web server process?

   • ABrowser history files
   • BWindows event logs
   • CPrefetch files
   • DNetwork socket information in kernel memory
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A memory dump from a web server contains a suspicious process that is injecting code into the w3wp.exe process. The injected code includes a function that hooks the InternetReadFile API. Which behavior is the malware most likely attempting?

   • ALogging keystrokes from the server console
   • BIntercepting and modifying web responses to inject malicious content
   • CStealing the server's private key
   • DPerforming a denial-of-service attack
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is a common source of digital evidence generated during a web attack?

   • AWeb server access logs
   • BPrinter spool files
   • CCPU temperature logs
   • DBIOS configuration settings
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A web server is serving a JavaScript file that has been modified to include a keylogger. You need to analyze the script to understand its behavior. Which analysis method would be most efficient for a large, obfuscated script?

   • ACheck the script's HTTP headers for malicious indicators
   • BUse a JavaScript deobfuscator and then run it in a sandboxed browser to observe network calls
   • CSearch for the script's hash on VirusTotal
   • DManually read the entire script line by line
   Reveal Solution Discussion Select an answer first