Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A system administrator reviews the following web server access log entries associated with an internal audit endpoint:

192.168.1.45 - - [27/Jul/2026:14:22:01 +0000] "POST /api/v1/query HTTP/1.1" 200 4520 "id=101+UNION+SELECT+username,password_hash+FROM+users--" "Mozilla/5.0"
192.168.1.45 - - [27/Jul/2026:14:22:05 +0000] "POST /api/v1/query HTTP/1.1" 200 5120 "id=101' OR '1'='1" "Mozilla/5.0"

Which type of attack vector do these log entries demonstrate, and what is the most effective application-level mitigation?

  1. SQL injection (SQLi); mitigate by implementing parameterized queries and prepared statements.Answer
  2. B
    Cross-Site Scripting (XSS); mitigate by implementing context-aware HTML output encoding.
  3. C
    Broken Authentication; mitigate by enforcing multi-factor authentication (MFA) across access gateways.
  4. D
    Remote Code Execution (RCE); mitigate by deploying a network-based detective firewall.

Answer

SQL injection (SQLi); mitigate by implementing parameterized queries and prepared statements.
The log entries clearly display classic SQL injection patterns (`UNION SELECT` attempting data exfiltration from `users` and `' OR '1'='1` attempting boolean bypass). Parameterized queries (prepared statements) enforce strong type separation between code and data at the application layer, neutralizing SQL injection vulnerabilities.

Step-by-Step Solution

1
Analyze the request payload parameters in the HTTP POST log entries.
Identified SQL command keywords (`UNION SELECT`, `FROM users`, `' OR '1'='1`) embedded in the `id` parameter.
Log analysis requires inspecting user-supplied input strings to recognize attack signature patterns.
2
Determine the targeted system component and vulnerability class.
The payload targets the backend database interpreter via untrusted input concatenated into SQL statements (SQL Injection).
Distinguishing database command syntax from client-side script syntax clarifies the specific flaw.
3
Identify the primary preventive developer mitigation for SQL Injection.
Use parameterized queries (prepared statements) to separate data inputs from database code execution.
Pre-compiling SQL queries ensures user inputs are never parsed as executable SQL commands.

Key Concept

Identifying SQL Injection signatures in HTTP logs and applying parameterized query mitigations
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic