Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is inspecting web server access logs ingested into a SIEM platform. An automated correlation rule generated a low-priority informational alert after detecting directory path indicators in incoming HTTP requests. The SIEM displays the following sequential log entries:

192.168.1.45 - - [27/Jul/2026:14:22:01 +0000] "GET /api/v1/download?file=../../../../etc/passwd HTTP/1.1" 200 4096
192.168.1.45 - - [27/Jul/2026:14:22:05 +0000] "GET /api/v1/download?file=..%2f..%2f..%2f..%2fetc%2fshadow HTTP/1.1" 403 280

Based on these log entries, which of the following conclusions accurately identifies the security incident status and the required SIEM management action?

  1. A path traversal attack successfully accessed a sensitive system file on the first request, requiring the SIEM correlation rule severity to be escalated from informational to high.Answer
  2. B
    A Cross-Site Scripting (XSS) payload successfully executed within the user browser session, requiring a new SIEM correlation rule to monitor database queries.
  3. C
    The log entries demonstrate a failed multi-factor authentication attempt, requiring access control policy updates rather than SIEM rule modifications.
  4. D
    The event represents a false positive alert because the HTTP 403 status code on the second request proves that web application firewall controls mitigated all risk.

Answer

A path traversal attack successfully accessed a sensitive system file on the first request, requiring the SIEM correlation rule severity to be escalated from informational to high.
The correct response recognizes that the HTTP status code 200 combined with a 4096-byte payload on the request containing path traversal sequences (../../../../etc/passwd) indicates that the application successfully served file contents to the attacker. Because the initial SIEM alert was categorized as low-priority/informational, the analyst must escalate the rule severity to ensure immediate incident response triggers upon successful exploitation.

Step-by-Step Solution

1
Analyze the request URI parameters in both log entries
Identified path traversal patterns (../../../../ and URL-encoded ..%2f..%2f..%2f..) targeting restricted system files (/etc/passwd and /etc/shadow).
Determining the threat vector requires evaluating the input payload within the HTTP GET request string.
2
Evaluate the HTTP response status codes and byte sizes in sequence
The first request returned HTTP status 200 (OK) with 4096 bytes transferred. The second request returned HTTP status 403 (Forbidden) with 280 bytes.
HTTP 200 indicates the server fulfilled the request and returned file content, whereas HTTP 403 indicates subsequent access blocking.
3
Determine the incident impact and required SIEM management response
Successful unauthorized retrieval of /etc/passwd confirms a successful breach. The low-priority SIEM rule failed to reflect the true severity.
SIEM correlation rules must be tuned to alert with high severity when directory traversal attempts return HTTP 200 success codes.

Key Concept

Directory Traversal Log Analysis and SIEM Alert Tuning
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic