Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A security analyst monitoring enterprise SIEM alerts identifies an anomalous HTTP payload captured by an inline Network Intrusion Detection System (NIDS) sensor placed in front of an internal application gateway:

POST /api/v2/products/search HTTP/1.1
Host: portal.internal.corp
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 62

item_id=55+UNION+SELECT+null,username,password_hash+FROM+users--

Which of the following correctly identifies the root cause of this alert and the appropriate technical mitigation?

  1. The alert indicates a SQL injection attack targeting the backend database; the vulnerability should be mitigated using parameterized queries or web application firewall filtering.Answer
  2. B
    The alert indicates a Cross-Site Scripting (XSS) attempt targeting user sessions; the vulnerability should be mitigated by updating endpoint antivirus signatures on web clients.
  3. C
    The alert indicates a deception technology honeypot trigger; the analyst should reconfigure the NIDS to act as an inline preventive control to block honeypot network ports.
  4. D
    The alert indicates a buffer overflow exploit on the web server network interface; the vulnerability should be mitigated by implementing perimeter firewall port filtering for ICMP traffic.

Answer

The alert indicates a SQL injection attack targeting the backend database; the vulnerability should be mitigated using parameterized queries or web application firewall filtering.
The captured NIDS payload shows an attacker passing SQL commands (`UNION SELECT null,username,password_hash FROM users--`) inside the `item_id` request parameter. This pattern explicitly targets backend database management systems via SQL Injection. Proper remediation requires enforcing parameterized queries (prepared statements) in application code and deploying Web Application Firewall (WAF) inspection rules.

Step-by-Step Solution

1
Analyze the log payload in the NIDS alert stem.
Identified the SQL syntax `UNION SELECT null,username,password_hash FROM users--` injected into the `item_id` parameter.
Recognizing SQL statements within user input parameters isolates the attack vector to application-layer database manipulation.
2
Differentiate between web application attack types.
Confirmed the attack is SQL Injection (SQLi) rather than Cross-Site Scripting (XSS) or a network-layer memory buffer overflow.
SQLi attempts to read or modify database content, while XSS executes client-side scripts in the victim browser.
3
Determine the effective security control for mitigation.
Selected parameterized queries (prepared statements) at the application code level and Web Application Firewall (WAF) filtering at the network monitoring level.
Parameterized queries separate SQL code from user data, preventing unauthorized payload execution, while WAFs inspect layer-7 application traffic.

Key Concept

Network Intrusion Detection Log Analysis and SQL Injection Mitigation
Estimated Time:1m 30s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic