Examkin

Question

Difficulty: Very hardNetwork Security Monitoring and Alerting

During a network security monitoring review of a cloud environment, a security analyst examines the following NIDS alert log associated with an internal application gateway:

Timestamp: 2026-07-27T14:22:01Z
Src_IP: 192.168.10.45:49152 -> Dst_IP: 10.0.4.12:80
Signature: HTTP_Req_Pattern_Match
Payload Snippet: POST /search.php HTTP/1.1\r
Host: store.internal\r
User-Agent: Mozilla/5.0\r
Content-Type: application/x-www-form-urlencoded\r
Content-Length: 68\r
\r
item=1+UNION+SELECT+null,username,password_hash+FROM+users--

Following this initial request, outbound firewall logs capture sustained 15-minute periodic TCP connections from 10.0.4.12 to an external IP address over port 443. Based on the log evidence, which of the following represents the most accurate diagnosis of the activity and the appropriate immediate analyst action?

  1. The alert indicates a successful SQL injection exploit leading to potential data exfiltration; the analyst should immediately isolate the web server (10.0.4.12) to contain potential command and control activity.Answer
  2. B
    The alert indicates a Cross-Site Scripting (XSS) attack attempting to execute scripts in the user's browser; the analyst should deploy an inline script-blocking policy on the client workstation (192.168.10.45).
  3. C
    The alert indicates a misconfigured honeypot decoy system triggering automated alerts; the analyst should reclassify the NIDS signature from a detective control to an inline preventive control to auto-drop future packets.
  4. D
    The alert indicates an application vulnerability; the analyst should immediately modify perimeter firewall rules to block inbound TCP port 80 traffic to prevent further web traffic.

Answer

The alert indicates a successful SQL injection exploit leading to potential data exfiltration; the analyst should immediately isolate the web server (10.0.4.12) to contain potential command and control activity.
Analyzing the payload snippet reveals a classic SQL injection pattern (`UNION SELECT null,username,password_hash FROM users--`) attempting to extract user credentials from a backend database. Correlating this NIDS alert with the subsequent sustained outbound TCP port 443 sessions from the target web server indicates potential post-exploitation activity or data exfiltration. Isolating the target web server halts egress communications while enabling forensic analysis.

Step-by-Step Solution

1
Analyze NIDS HTTP payload syntax
Identified 'UNION SELECT null,username,password_hash FROM users--' as a SQL injection (SQLi) attack targeting backend database credentials.
Determines the specific attack vector targeting the database application logic.
2
Correlate NIDS payload with outbound NetFlow/Firewall logs
Observed subsequent persistent outbound traffic over TCP port 443 from the target server (10.0.4.12) to an external IP.
Establishes post-exploitation behavior indicative of data exfiltration or Command and Control (C2) beaconing.
3
Determine containment response action
Selected network isolation of server 10.0.4.12.
Prevents ongoing outbound data exfiltration while preserving memory and system state for digital forensics.

Key Concept

SQL Injection Alert Diagnosis and Containment Correlation
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic