Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A Security Operations Center (SOC) analyst is reviewing an alert triggered by a perimeter Network Intrusion Detection System (NIDS). The NIDS captured the following HTTP request payload targeting an internal customer portal:

GET /catalog.php?item=42%20UNION%20SELECT%20username,password_hash%20FROM%20user_credentials-- HTTP/1.1
Host: portal.company.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

Based on this network security monitoring alert, which of the following is the most accurate assessment of the threat and the appropriate immediate analyst action?

  1. The log indicates a SQL injection attempt aiming to extract database content; the analyst should check Web Application Firewall (WAF) and SIEM logs to verify if the server responded with successful data execution.Answer
  2. B
    The log indicates a Cross-Site Scripting (XSS) attack attempting to execute scripts in user browsers; the analyst should clear active client session tokens across all endpoints.
  3. C
    The log indicates a network deception event trapped by a honeypot; the analyst can assume the threat is completely neutralized without further log investigation.
  4. D
    The log indicates a network protocol buffer overflow; the analyst should immediately reconfigure perimeter firewall rules to block all inbound HTTP traffic on port 80.

Answer

The alert represents a SQL injection attempt targeting database records, requiring the analyst to correlate SIEM web server logs and HTTP response status codes to assess impact.
The payload contains URL-encoded SQL commands (`UNION SELECT`), which signifies a SQL injection attempt targeting the backend database. In network security monitoring, receiving a NIDS alert for an inbound payload requires verifying downstream web server and database logs in the SIEM to check whether the application processed the request successfully.

Step-by-Step Solution

1
Analyze the captured NIDS payload snippet
Identified URL-encoded SQL commands ('UNION SELECT username,password_hash FROM user_credentials--').
Recognizing database syntax within HTTP parameter inputs isolates the threat vector as SQL injection.
2
Determine the scope and target of the attack
The attack targets backend database content via an unformatted web request parameter.
Distinguishing database queries from client-side script payloads ensures proper incident classification.
3
Select the appropriate network monitoring triage step
Query SIEM and web application logs for corresponding HTTP status codes (e.g., 200 OK vs 500 Internal Error) and response payload size.
NIDS alerts indicate detection of request payloads; verifying response logs determines whether the vulnerability was successfully exploited.

Key Concept

NIDS Log Payload Analysis and Attack Triage
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic