Examkin

Question

Difficulty: EasyNetwork Security Monitoring and Alerting

A Security Operations Center (SOC) analyst is reviewing network intrusion detection system (NIDS) alerts monitoring an enterprise web application. The system generated an alert categorized as a Cross-Site Scripting (XSS) attempt after inspecting an HTTP request containing the payload `GET /login.php?user=admin' OR '1'='1'-- HTTP/1.1`. Which of the following best describes the analyst's evaluation of this alert?

  1. The alert is miscategorized because the payload represents a SQL injection attack attempting database query manipulation rather than client-side script execution.Answer
  2. B
    The alert is correctly categorized because SQL statements included within HTTP GET parameters are interpreted as client-side script execution by web browsers.
  3. C
    The alert indicates a detective control failure because the passive NIDS failed to block the malicious packet inline before reaching the server.
  4. D
    The alert should be resolved by reconfiguring a network-level stateless firewall to filter and sanitize application layer SQL strings in real time.

Answer

The alert is miscategorized because the payload represents a SQL injection attack attempting database query manipulation rather than client-side script execution.
The string `user=admin' OR '1'='1'--` is a signature of SQL injection, which targets backend relational database queries. Cross-Site Scripting (XSS) involves injecting client-side scripts (such as JavaScript) executed by the browser. Because the NIDS rule flagged a SQL injection vector as XSS, the analyst correctly evaluates the alert as miscategorized.

Step-by-Step Solution

1
Examine the captured HTTP payload from the NIDS alert log snippet
Identified the query parameter payload `user=admin' OR '1'='1'--`.
Analyzing the specific payload characters is required to determine the true nature of the network activity.
2
Classify the payload type against attack vector definitions
Recognized `OR '1'='1'` as a database query manipulation string used in SQL injection attacks.
SQL injection targets database query syntax, while Cross-Site Scripting (XSS) relies on client-side script tags such as JavaScript.
3
Assess the NIDS rule mapping accuracy
Concluded that the monitoring signature mislabeled a backend SQL injection attempt as an XSS alert.
Accurate alert classification ensures correct incident handling and threat reporting.

Key Concept

Network Security Monitoring Alert Interpretation and Attack Classification
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic