Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security engineer is reviewing correlated telemetry in a SIEM console containing the following web application firewall (WAF) and database audit events:

text
2026-07-27T14:15:02Z waf01 http_request client_ip=198.51.100.44 uri="/api/v1/catalog" status=200 payload="' UNION SELECT username, password_hash FROM accounts--"
2026-07-27T14:15:02Z db01 query_exec db_user="app_service" query="SELECT * FROM products WHERE category = '' UNION SELECT username, password_hash FROM accounts--'" rows_returned=1420

Which of the following attack vectors was successfully executed against the application based on these log entries?

  1. A
    Cross-Site Scripting (XSS) executing malicious client-side scripts inside the web browser.
  2. SQL injection bypassing query logic to exfiltrate unauthorized database records.Answer
  3. C
    Broken authentication caused by failure to enforce access authorization controls on the API gateway.
  4. D
    A SIEM correlation engine parsing error misclassifying standard application traffic as a database anomaly.

Answer

SQL injection bypassing query logic to exfiltrate unauthorized database records.
The WAF log captures a classic SQL injection vector (`UNION SELECT`), and the correlated database audit log shows that the query executed successfully (`rows_returned=1420`). This proves an SQL injection attack successfully extracted data from the database.

Step-by-Step Solution

1
Analyze the WAF log payload
The HTTP request payload contains `' UNION SELECT username, password_hash FROM accounts--`, which is SQL syntax designed to join additional query results.
Identifying SQL syntax in HTTP parameters pinpoints a database-targeted attack vector.
2
Correlate the WAF entry with the backend database audit log
The database log shows the exact injected string integrated into the executed query (`query_exec`) returning 1420 rows with a status of HTTP 200.
Matching timestamps and matching query strings across WAF and DB logs confirms successful server-side execution and data retrieval.

Key Concept

Correlating WAF payloads with database execution logs to detect SQL Injection
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic