Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

An incident investigation team is analyzing correlated telemetry captured by an enterprise SIEM from an API Gateway (APIGW) and an Identity Provider (IDP):

text
2026-03-14T08:12:01Z [APIGW] src_ip=198.51.100.44 method=POST uri="/api/v1/auth/login" status=200 user="j_doe"
2026-03-14T08:12:05Z [IDP] user="j_doe" auth_method="MFA_TOTP" status="SUCCESS" src_ip=198.51.100.44
2026-03-14T08:12:12Z [APIGW] src_ip=198.51.100.44 method=GET uri="/api/v1/admin/export" status=403 user="j_doe" error="InsufficientPrivileges"
2026-03-14T08:12:18Z [APIGW] src_ip=198.51.100.44 method=POST uri="/api/v1/users/j_doe/roles" status=200 payload="{\"add_role\":\"GlobalAdmin\"}"
2026-03-14T08:12:25Z [APIGW] src_ip=198.51.100.44 method=GET uri="/api/v1/admin/export" status=200 user="j_doe" bytes_sent=4194304

Based on the log sequence above, which of the following security events occurred?

  1. The account successfully passed authentication but exploited a broken authorization control to elevate privileges and download restricted data.Answer
  2. B
    The user failed initial authentication at timestamp 08:12:12Z, causing the API gateway to terminate the underlying session token.
  3. C
    The SIEM correlation engine misidentified the threat because the log stream indicates a SQL injection payload executed against the authentication service.
  4. D
    The API gateway functioned as a detective control by blocking all requests associated with the IP address 198.51.100.44 throughout the sequence.

Answer

The account successfully passed authentication but exploited a broken authorization control to elevate privileges and download restricted data.
The sequence of SIEM telemetry shows that the account successfully authenticated via multi-factor authentication, received an HTTP 403 Forbidden error when attempting to reach an admin endpoint, successfully issued a request to self-assign the 'GlobalAdmin' role, and subsequently retrieved data from the admin endpoint. This indicates a broken access control vulnerability permitting unauthorized privilege escalation.

Step-by-Step Solution

1
Analyze initial access telemetry
Timestamps 08:12:01Z and 08:12:05Z confirm identity verification (authentication) succeeded using primary credentials and MFA TOTP.
Establishing valid identity precedes assessing access permissions.
2
Evaluate the HTTP 403 response at 08:12:12Z
The user attempted to reach `/api/v1/admin/export` but received HTTP 403 (Forbidden) with `error="InsufficientPrivileges"`.
HTTP 403 demonstrates that while the identity is known, the authorization rule blocked access.
3
Trace privilege escalation and successful exfiltration
At 08:12:18Z, a POST request to `/api/v1/users/j_doe/roles` granted `GlobalAdmin` permissions, enabling the subsequent GET request at 08:12:25Z to return HTTP 200 and transmit 4,194,304 bytes.
Correlating timestamps reveals an unauthorized permission modification that bypassed proper administrative controls.

Key Concept

Distinguishing authentication from authorization failures during SIEM log correlation and identifying privilege escalation attacks.
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic