`), identifying it as an XSS attack vector. Meanwhile, the NetFlow record shows automated, fixed-interval outbound traffic over UDP"}},"eduQuestionType":"Multiple choice","isAccessibleForFree":true},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Examkin","item":"https://examkin.com/en"},{"@type":"ListItem","position":2,"name":"CompTIA Security+","item":"https://examkin.com/en/exams/comptia-security-plus"},{"@type":"ListItem","position":3,"name":"Security Operations","item":"https://examkin.com/en/exams/comptia-security-plus/t/SECURITY_CORE__security_operations"},{"@type":"ListItem","position":4,"name":"Network Security Monitoring and Alerting","item":"https://examkin.com/en/exams/comptia-security-plus/t/SECURITY_CORE__security_operations__network_security_monitoring_and_alerting"},{"@type":"ListItem","position":5,"name":"Question","item":"https://examkin.com/en/exams/comptia-security-plus/q/503270b8-c799-4bab-9774-399eba807a75"}]}]

A security analyst is evaluating correlated SIEM telemetry generated by network security monitoring sensors for host 172.16.10.45:

NIDS Alert:
[ALERT] [1:1002941:2] WEB-ATTACK HTTP POST /api/v1/user?input=%3Cscript%3Ealert%281%29%3C%2Fscript%3E HTTP/1.1

NetFlow Log:
SrcIP: 172.16.10.45 | DstIP: 198.51.100.55 | DstPort: 53/UDP | Packets: 4 | Bytes: 216 | Interval: 30s (Recurring)

Based on the network security monitoring telemetry provided, which of the following conclusions are accurate? (Select TWO).

1. The NIDS alert indicates a Cross-Site Scripting (XSS) payload attempt targeting the Web API rather than a SQL injection attack.Answer
2. The NetFlow telemetry pattern indicates potential Command and Control (C2) beaconing or DNS tunneling activity.Answer
3. C
   The NIDS alert identifies an active database exfiltration attempt utilizing SQL injection commands.
4. D
   The recurring NetFlow UDP port 53 traffic represents a production honeypot configured to automatically inline-block perimeter traffic.

Answer

The correct conclusions are that the NIDS alert indicates a Cross-Site Scripting (XSS) payload attempt targeting the Web API rather than a SQL injection attack, and the NetFlow telemetry pattern indicates potential Command and Control (C2) beaconing or DNS tunneling activity.

The NIDS payload decodes to standard JavaScript script execution (`<script>alert(1)</script>`), identifying it as an XSS attack vector. Meanwhile, the NetFlow record shows automated, fixed-interval outbound traffic over UDP port 53 (DNS) to an external host, which is a key indicator of compromise (IoC) for C2 beaconing or DNS covert channel tunneling.

Step-by-Step Solution

1

Analyze the NIDS alert HTTP POST request payload.

The URL parameter `input=%3Cscript%3Ealert%281%29%3C%2Fscript%3E` represents URL-encoded HTML/JavaScript `<script>alert(1)</script>`, confirming a Cross-Site Scripting (XSS) probe.

Differentiating client-side script injection (XSS) from server-side database commands (SQLi) is essential for accurate alert diagnosis.

2

Analyze the NetFlow telemetry log for connection patterns.

The log displays consistent outbound UDP port 53 traffic occurring at precise 30-second intervals with uniform low byte sizes to external IP 198.51.100.55.

Periodic small-byte traffic to external DNS servers indicates automated C2 beaconing or DNS tunneling network behavior.

Key Concept

Network Security Monitoring Log Analysis and Threat Identification

Common Mistakes

Estimated Time:2m 0s