HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which HTTP request pattern is characteristic of a directory traversal attack?

   • AUsing a POST request with a large body
   • BUsing an unusual User-Agent
   • CUsing a long query string
   • DUsing ../ sequences in the URL path
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the root cause of HTTP request smuggling?

   • AThe use of HTTP/2 multiplexing
   • BDiscrepancies in how front-end and back-end servers interpret request boundaries
   • CMisconfigured cookies
   • DWeak TLS encryption
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which HTTP header is used by the server to instruct the browser to store a session identifier?

   • AContent-Length
   • BReferer
   • CCookie
   • DSet-Cookie
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A SOC analyst is baselining HTTP traffic for a web application. The baseline shows that the average request rate is 100 requests per minute, with a standard deviation of 20. The average request size is 500 bytes, and the average response size is 2 KB. During a monitoring period, the analyst observes a spike to 500 requests per minute, with an average request size of 5 KB and an average response size of 10 KB. The source IPs are distributed across multiple countries. Which conclusion is most consistent with this observation?

   • AThe traffic is likely an anomaly, possibly a DDoS attack or a botnet, and the analyst should investigate the source IPs and request patterns
   • BThe traffic is a web scraping bot that is downloading large amounts of data
   • CThe traffic is a false positive caused by a legitimate marketing campaign
   • DThe traffic is a normal increase due to a new feature release
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A SOC analyst is monitoring outbound HTTP traffic from a corporate network. The analyst observes a single internal host making GET requests to a known malicious domain at a rate of exactly one request every 60 seconds. Each request has a unique URI path that appears to be a random 16-character string, and the response body is always the same small size. Which HTTP characteristics should the analyst use to classify this traffic as botnet command-and-control?

   • AThe regular request interval, the random-looking URI paths, and the consistent response size
   • BThe request originating from a single internal host and the response body being the same size
   • CThe destination being a known malicious domain and the use of HTTP instead of HTTPS
   • DThe use of the GET method and the small response body size
   Reveal Solution Discussion Select an answer first