Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is investigating an automated SIEM alert triggered during incident response telemetry collection. The analyst reviews the following correlated chronological log snippet collected from an internal host (`host-app01`), a perimeter Web Application Firewall (`WAF-EDGE01`), and a backend database server (`db-prod01`):

[2026-07-27T14:10:02Z] host-app01 sshd[14201]: Failed password for root from 10.0.4.88 port 49152 ssh2
[2026-07-27T14:10:04Z] host-app01 sshd[14205]: Accepted password for svc_deploy from 10.0.4.88 port 49154 ssh2
[2026-07-27T14:12:30Z] WAF-EDGE01 action="ALERT_ONLY" src="10.0.4.88" uri="/db_admin.php?user=admin' OR '1'='1" signature="SQLi_Generic_Clause"
[2026-07-27T14:13:01Z] db-prod01 mariadb[882]: [Access Granted] User 'svc_deploy'@'10.0.4.88' executed query: "SELECT * FROM customer_pii;"

Based on the log telemetry above, which of the following security findings and incident conclusions are correct? (Select TWO.)

  1. The threat actor gained access by authenticating with valid service account credentials following a failed attempt to log in as root.Answer
  2. The compromised account was used to execute direct queries retrieving sensitive customer personally identifiable information (PII) from the database daemon.Answer
  3. C
    The WAF log entry confirms that the attacker executed a client-side Cross-Site Scripting (XSS) payload targeting administrative web browser sessions.
  4. D
    The SSH authentication failure for the root user indicates an authorization control enforcement failure rather than an identity verification check failure.

Answer

The correct findings are: (1) The threat actor gained access by authenticating with valid service account credentials following a failed root login attempt, and (2) The compromised account was used to execute direct queries retrieving sensitive customer PII from the database.
Correlating timestamps and IP address 10.0.4.88 across all three system logs demonstrates that an attacker attempted to log in as root, successfully authenticated as 'svc_deploy', launched SQL injection probes against the web application, and executed SQL queries extracting customer PII directly from the database.

Step-by-Step Solution

1
Analyze host authentication telemetry
Identified a failed root login attempt followed by a successful login for 'svc_deploy' from source IP 10.0.4.88.
Establishing initial access vector and credential usage from host log entries.
2
Analyze WAF security alert log
Identified a SQL injection payload (' OR '1'='1) originating from the same source IP 10.0.4.88.
Determining web-layer attack vectors and distinguishing SQL injection signatures from other web application attack types.
3
Correlate database audit log with host credentials
Confirmed that the compromised service account 'svc_deploy' issued queries exfiltrating customer PII data.
Mapping sequential actions across multiple log sources to establish impact and scope of compromise.

Key Concept

Cross-device log correlation and attack vector identification within SIEM analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic