Examkin

Question

Difficulty: HardNetwork Security Monitoring and Alerting

A security analyst is investigating a SIEM alert containing the URI parameter: `/inventory.php?item=10' UNION SELECT null, table_name FROM information_schema.tables--`. Moments later, network security monitoring sensors record outbound traffic originating from the targeted web server to an IP address within an isolated deception subnet (honeypot). Which of the following statements accurately identifies the attack technique observed and the operational purpose of the triggered deception control?

  1. The URI payload represents a SQL injection attempt, and the honeypot alert acts as a detective control indicating potential lateral movement or scanning by the attacker.Answer
  2. B
    The URI payload represents a Cross-Site Scripting (XSS) attack, and the honeypot alert acts as a detective control indicating potential lateral movement or scanning by the attacker.
  3. C
    The URI payload represents a SQL injection attempt, and the honeypot functioned as an inline preventive control by dropping the malicious HTTP request before reaching the database.
  4. D
    The URI payload represents a SQL injection attempt, and the analyst's primary immediate remediation should be modifying network firewall port-filtering rules.

Answer

The attack vector is SQL injection, and traffic touching a honeypot serves as a detective control to spot unauthorized network activity.
The URI payload uses SQL syntax ('UNION SELECT') to query database metadata, which is characteristic of SQL injection. Honeypots are deception mechanisms deployed to capture unauthorized interactions, serving as detective controls when suspicious hosts attempt internal probing.

Step-by-Step Solution

1
Analyze the URI string pattern in the SIEM alert log.
Identify 'UNION SELECT null, table_name FROM information_schema.tables--', which is characteristic of database query manipulation (SQL injection).
Distinguishing application layer payloads is essential for accurate incident triage.
2
Evaluate the role of the network monitoring sensor alert triggered in the deception subnet.
Recognize that honeypots have no legitimate business traffic and function as detective controls for early threat detection.
Honeypots do not act as inline blocking mechanisms; any traffic routed to them indicates suspicious or compromised behavior.
3
Synthesize findings to select the accurate diagnosis.
Confirm that the incident involves SQL injection followed by internal reconnaissance/lateral movement detected by a honeypot.
Combines attack payload classification with correct security control operational classification.

Key Concept

Network Security Monitoring and Deception Analysis
Estimated Time:2m 0s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic