Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security specialist investigates an automated alert triggered in a Security Information and Event Management (SIEM) dashboard. The alert aggregates logs from the web application firewall (WAF) and the database audit logger as shown below:

[2026-07-27T14:02:11Z] WAF_LOG: Src=203.0.113.84 URI="/search.php?item=1%27%20OR%201=1--" Action=ALLOWED HTTP_Status=200
[2026-07-27T14:02:15Z] DB_AUDIT: User=app_web Query="SELECT * FROM items WHERE item_id = '1' OR 1=1--" Execution_Status=SUCCESS RowsReturned=84200
[2026-07-27T14:02:18Z] SIEM_CORRELATION: RuleID=RL-4092 Trigger="High Volume Data Read Post WAF Anomaly"

Based on these correlated log entries, which of the following security events is actively occurring?

  1. A
    A Cross-Site Scripting (XSS) attack that executed malicious client-side script in the database user's web browser session.
  2. A successful SQL Injection (SQLi) attack that bypassed web application filtering and resulted in unauthorized data retrieval.Answer
  3. C
    An authentication control failure where invalid user credentials were accepted by the database server connection pool.
  4. D
    A SIEM false positive caused by a misconfigured detective control misidentifying routine database replication traffic.

Answer

A successful SQL Injection (SQLi) attack that bypassed web application filtering and resulted in unauthorized data retrieval.
The correct answer identifies a successful SQL Injection attack. The WAF log captures the URI parameter containing the classic SQL syntax injection `1' OR 1=1--`. The database audit log demonstrates that the input was passed un-sanitized into the SQL query statement, evaluating `1=1` to true for all rows and returning 84,200 database records.

Step-by-Step Solution

1
Analyze the WAF log payload
The HTTP request contains the URL parameter `item=1' OR 1=1--`, which utilizes SQL metacharacters (`'` and `--`) to alter database query syntax.
Recognizing attack signatures in web logs is necessary to determine the threat vector.
2
Examine the DB Audit log entry
The web application account executed `SELECT * FROM items WHERE item_id = '1' OR 1=1--` and returned 84,200 records.
Verifying database logs confirms whether the injected payload reached the backend and executed successfully.
3
Correlate event timeline and SIEM rule trigger
The SIEM successfully correlated the WAF payload with the subsequent bulk database read, confirming an active SQL injection data exfiltration attempt.
Correlating timestamped logs across heterogeneous systems allows analysts to validate true positive incidents.

Key Concept

Log Analysis and SIEM Event Correlation
Estimated Time:1m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic