Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

Match each security log entry or SIEM telemetry event to the attack vector or operational activity it most accurately demonstrates.

  • GET /catalog.php?cat_id=5%20UNION%20SELECT%20table_name,column_name%20FROM%20information_schema.tables-- HTTP/1.1 200SQL Injection (SQLi)
  • sshd[8841]: Failed password for root from 198.51.100.77 port 41202 ssh2 (Frequency: 850 events / 60 seconds)SSH Automated Password Guessing (Brute Force)
  • DENY TCP src=203.0.113.19:54112 dst=10.0.4.15:3389 action=drop interface=WAN_INBlocked Unauthorized RDP Access Attempt
  • SIEM_RULE_104: High-frequency TXT query requests for subdomains under *.malicious-dns.net carrying encoded payload strings from internal host 10.0.1.22DNS Tunneling / Covert Data Exfiltration

Answer

Matching pairs: Web log with UNION SELECT matches SQL Injection (SQLi); SSH failed password burst matches SSH Automated Password Guessing (Brute Force); Firewall drop on TCP port 3389 matches Blocked Unauthorized RDP Access Attempt; High-volume encoded DNS TXT queries match DNS Tunneling / Covert Data Exfiltration.
Each log line provides specific indicators of compromise (IoCs): database keywords indicate SQL injection; high-rate SSH authentication failure indicates brute force; firewall drops on port 3389 indicate blocked remote access attempts; and continuous encoded DNS query patterns indicate DNS tunneling.

Step-by-Step Solution

1
Analyze the web server log entry containing URL query parameters.
Identified 'UNION SELECT' syntax targeting database tables, indicating SQL Injection (SQLi).
Attackers inject database queries into input parameters to extract unauthorized data.
2
Examine the SSH daemon authentication log snippet and timestamp frequency.
Identified 850 failed root password attempts in 60 seconds, indicating SSH Automated Password Guessing (Brute Force).
Rapid successive authentication failures from a single host demonstrate automated dictionary or brute-force attacks.
3
Evaluate the firewall packet filtering log telemetry.
Identified dropped inbound traffic on destination port 3389, indicating Blocked Unauthorized RDP Access Attempt.
TCP port 3389 is the default port for Remote Desktop Protocol, and the DENY action reflects perimeter firewall mitigation.
4
Inspect the SIEM correlation alert for outbound protocol anomalies.
Identified repeated encoded TXT sub-domain queries, indicating DNS Tunneling / Covert Data Exfiltration.
DNS tunneling encodes arbitrary payload data inside subdomains or TXT records to bypass standard security filters.

Key Concept

Log Analysis and SIEM Correlation
Estimated Time:1m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic