Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

During a security monitoring shift, an analyst reviews the following alert log snippet generated by a perimeter Network Intrusion Detection System (NIDS) inspecting traffic directed at an internal web application server:

[ALERT] 2026-07-27 14:12:08 UTC - NIDS-Rule-90421
Src: 198.51.100.44:48210 -> Dst: 172.16.10.15:443
Payload snippet: POST /catalog/search HTTP/1.1
Body: item=widget' UNION SELECT username, password_hash FROM user_credentials--

Based on this alert payload and monitoring data, which of the following correctly identifies the attack type and the appropriate analyst action?

  1. Identify the attack as SQL Injection (SQLi) aimed at extracting backend database records, and initiate containment by blocking the source IP or reviewing backend query logs.Answer
  2. B
    Identify the attack as Cross-Site Scripting (XSS) designed to execute client-side scripts in user browsers, and update Content Security Policy (CSP) headers.
  3. C
    Classify the NIDS alert as a failure of a preventive control because the NIDS did not automatically block and drop the incoming TCP connection inline.
  4. D
    Mitigate the vulnerability by implementing network perimeter firewall rules that permanently block inbound traffic on port 443.

Answer

Identify the attack as SQL Injection (SQLi) aimed at extracting backend database records, and initiate containment by blocking the source IP or reviewing backend query logs.
The alert payload explicitly shows SQL commands ('UNION SELECT... FROM user_credentials') injected into an HTTP POST request parameter. This confirms a SQL injection attack targeting backend database confidentiality. Because a NIDS is a detective monitoring control, alerting security analysts to initiate containment (such as IP blocks or database log analysis) is the appropriate operational response.

Step-by-Step Solution

1
Analyze the NIDS alert payload snippet
The string 'UNION SELECT username, password_hash FROM user_credentials--' contains SQL keywords intended to append queries to backend database calls.
Recognizing database manipulation syntax isolates the vector as a server-side SQL injection attempt rather than a client-side execution attempt.
2
Differentiate network security monitoring control functions
Confirm that NIDS serves as a detective monitoring tool that generates alerts rather than actively dropping inline traffic like a NIPS.
Analyst triage requires understanding tool capabilities to determine manual vs automated response steps.
3
Select effective incident response triage actions
Block the originating external IP address and inspect database execution logs to confirm if any data exfiltration succeeded.
Targeted IP containment and targeted log correlation mitigate threat progression without shutting down necessary application ports.

Key Concept

NIDS Log Payload Analysis and Incident Identification
Estimated Time:1m 30s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic