Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A security analyst reviewing network security monitoring logs spots an alert triggered by an HTTP POST payload sent to an internal web application: `POST /api/search HTTP/1.1 Host: app.internal Payload: vendor_id=102 UNION SELECT username, password_hash FROM user_accounts--`. The analyst must identify the nature of the alert and determine the correct mitigation step without disabling HTTP services across the enterprise subnet. Which of the following correctly categorizes this attack vector and specifies the appropriate security control?

  1. The event represents a SQL injection attack; input validation and parameterized queries or WAF inspection rules should be applied.Answer
  2. B
    The event represents a cross-site scripting (XSS) attack; Content Security Policy (CSP) headers should be deployed to prevent client script execution.
  3. C
    The event represents a SQL injection attack; network firewall rules should be updated to block all inbound traffic on TCP port 443.
  4. D
    The event represents a cross-site scripting (XSS) attack; the passive Network Intrusion Detection System (NIDS) should be reconfigured to block packet stream delivery inline.

Answer

The correct answer identifies the event as a SQL injection attack and recommends implementing application input validation, parameterized database queries, or WAF filtering rules.
The alert payload explicitly uses SQL database command structures (`UNION SELECT ... --`) attempting to extract data from backend tables. Mitigating SQL injection requires application-layer sanitization, prepared statements, or WAF inspection.

Step-by-Step Solution

1
Analyze the observed network alert payload
The payload contains `UNION SELECT username, password_hash FROM user_accounts--`, which is SQL syntax designed to extract data from a relational database.
Recognizing database query keywords confirms that the payload targets database interpreters rather than client-side script execution engines.
2
Evaluate appropriate remediation controls for web database attacks
Application-level defenses such as parameterized queries, prepared statements, and Web Application Firewall (WAF) inspection effectively neutralize SQL injection without disrupting underlying network connectivity.
Network layer controls like port blocking are overly broad and disrupt legitimate service availability.

Key Concept

Network Security Monitoring & Web Application Attack Triage
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic