Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is investigating an alert and reviews the following web application access log entries ingested by the SIEM:

192.168.1.50 - - [27/Jul/2026:14:10:02 +0000] "GET /products.php?id=1 HTTP/1.1" 200 4520
192.168.1.50 - - [27/Jul/2026:14:10:15 +0000] "GET /products.php?id=1%27%20OR%20%271%27%3D%271 HTTP/1.1" 200 18450
192.168.1.50 - - [27/Jul/2026:14:10:22 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users HTTP/1.1" 200 32100
192.168.1.50 - - [27/Jul/2026:14:11:05 +0000] "POST /admin/login.php HTTP/1.1" 302 412

Based on the log analysis, which of the following best identifies the type of attack occurring and the most effective preventive control?

  1. SQL injection attack attempting database schema extraction; mitigate by implementing parameterized queries and input sanitization.Answer
  2. B
    Cross-Site Scripting (XSS) attack attempting session hijacking; mitigate by enforcing Content Security Policy (CSP) headers and encoding output.
  3. C
    Credential brute-force attack on the administrative login page; mitigate by implementing account lockout rules and multi-factor authentication (MFA).
  4. D
    False positive generated by misconfigured SIEM correlation parsing rules; mitigate by lowering the SIEM event count threshold for HTTP 200 codes.

Answer

SQL injection attack attempting database schema extraction; mitigate by implementing parameterized queries and input sanitization.
The correct response accurately identifies SQL injection based on the presence of SQL syntax (`OR '1'='1'` and `UNION SELECT`) in the URL request parameters, and pairs it with prepared statements (parameterized queries), which are the standard primary defense against SQL injection.

Step-by-Step Solution

1
Analyze URL parameter patterns in the web log entries
Identified URL-encoded SQL syntax elements: `%27%20OR%20%271%27%3D%271` translates to `' OR '1'='1`, and `%20UNION%20SELECT%20username,password%20FROM%20users` indicates database enumeration.
URL parameters containing database query commands are signature indicators of SQL injection (SQLi).
2
Evaluate server response codes and response sizes
HTTP 200 status codes with response sizes growing from 4,520 bytes to 32,100 bytes demonstrate successful execution and extraction of database content.
SIEM log analysis relies on combining request payloads with HTTP status codes and response length anomalies to confirm successful exploitation.
3
Select the appropriate primary security control
Parameterized queries (prepared statements) ensure that user input is treated strictly as parameter data rather than executable SQL code.
Prepared statements directly address the root vulnerability in application source code.

Key Concept

Web Server Log Analysis and SQL Injection Correlation
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic