Examkin

Soru

Zorluk: ZorNetwork Security Monitoring and Alerting

A security engineer analyzing packet telemetry from an inline Network Intrusion Prevention System (NIPS) notices a high-priority alert triggered by inbound traffic directed at a public-facing web server. The alert details contain the following HTTP payload snippet:

`GET /catalog.php?item_id=105%27%20UNION%20SELECT%20null,username,password_hash%20FROM%20user_credentials--%20HTTP/1.1`
`Host: portal.example.com`

The engineer must select a targeted mitigation control that specifically blocks this attack payload while preserving uninterrupted HTTP/HTTPS access for legitimate users. Which of the following actions should the engineer take?

  1. Deploy a Web Application Firewall (WAF) rule to inspect layer 7 payload parameters and block requests containing SQL syntax tokens.Cevap
  2. B
    Implement Content Security Policy (CSP) headers to sanitize dynamic user inputs and block script execution in client browsers.
  3. C
    Add a stateful network firewall rule to drop all incoming TCP port 80 and 443 traffic originating from external subnets.
  4. D
    Reroute incoming connections matching the URL pattern to an inline honeypot to filter out database queries before reaching the database server.

Cevap

Deploying a Web Application Firewall (WAF) rule to inspect layer 7 parameters and block requests containing SQL syntax tokens effectively mitigates the SQL injection payload while keeping standard web services available.
The log snippet reveals a URL-encoded SQL injection string (`UNION SELECT ... FROM user_credentials`). Because SQL injection is an application-layer (Layer 7) vulnerability, a Web Application Firewall (WAF) is the appropriate control. A WAF inspects HTTP/HTTPS payload contents and parameter values to block malicious database query structures while allowing benign web traffic through.

Adım Adım Çözüm

1
Analyze the NIPS log payload
Identified the URL-encoded payload `%27%20UNION%20SELECT%20null,username,password_hash%20FROM%20user_credentials--` as a classic SQL Injection (SQLi) attempt aimed at extracting database records.
Accurate alert classification is necessary to choose an effective mitigation strategy.
2
Evaluate control layer requirements
SQL injection attacks occur at Layer 7 (Application layer) inside standard HTTP request parameters.
Traditional network firewalls Operating at Layer 3/4 cannot inspect application payloads and would block all legitimate traffic if port-level blocks were applied.
3
Select the precise security control
A Web Application Firewall (WAF) operates at Layer 7 to inspect parameter values against signature patterns (such as `UNION SELECT`) and block malicious attempts without disrupting valid traffic.
WAF rules provide target-specific inline protection against web application attacks.

Anahtar Kavram

Layer 7 Network Security Monitoring and WAF Mitigation
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru