Examkin

Soru

Zorluk: Çok zorNetwork Security Monitoring and Alerting

A Security Operations Center analyst investigates a network intrusion detection system (NIDS) alert generated by telemetry from an internal application gateway servicing database queries. The raw payload captured in the monitoring alert log reads as follows:

http
POST /api/v1/query HTTP/1.1
Host: dbgateway.internal.net
User-Agent: CustomClient/2.4
Content-Type: application/x-www-form-urlencoded
Payload: account_id=1092%27+OR+%271%27%3D%271&session_token=8f9a2b

The security monitoring dashboard erroneously categorized this incident as a client-side Cross-Site Scripting (XSS) event and initiated an automated ticket to update client browser security policies. Based on the network telemetry provided, which of the following response and remediation measures should the analyst take? (Select TWO).

  1. Reclassify the alert within the SIEM as a server-side SQL injection attempt and adjust signature parsing rules for encoded database attack patterns.Cevap
  2. Deploy or tune an inline Web Application Firewall (WAF) to inspect application-layer HTTP POST parameters for database manipulation strings.Cevap
  3. C
    Enforce Document Object Model (DOM) sanitization policies across endpoints to block script execution in browser environments.
  4. D
    Reconfigure perimeter deception honeypots to operate inline directly on the API gateway segment to filter out malicious network packets.

Cevap

The analyst should reclassify the event as a server-side SQL injection attempt while adjusting NIDS parsing signatures, and implement or tune a Web Application Firewall (WAF) to inspect HTTP POST application parameters.
The captured HTTP POST payload contains the URL-encoded sequence `%27+OR+%271%27%3D%271`, which decodes to `' OR '1'='1`. This syntax is a classic SQL injection vector targeting backend database logic rather than client-side script execution. Consequently, the analyst must reclassify the SIEM alert to reflect a server-side SQL injection attack and update NIDS detection rules. Additionally, implementing or tuning a Web Application Firewall (WAF) provides the necessary application-layer (Layer 7) packet inspection to block malicious SQL parameters prior to reaching backend gateways.

Adım Adım Çözüm

1
Analyze the URL-encoded payload contained within the network monitoring alert.
Decoded payload `%27+OR+%271%27%3D%271` translates to `' OR '1'='1`, which is a standard SQL injection pattern intended to bypass authentication or database query boundaries.
Accurate alert interpretation prevents misdirected incident response procedures.
2
Identify the incorrect SIEM alert classification and remediation directive.
The dashboard misclassified a server-side database injection attempt as a client-side Cross-Site Scripting (XSS) attack.
Updating SIEM correlation rules and NIDS signatures ensures proper alert triage and future signature matching accuracy.
3
Select the appropriate network security control to block web application database attacks.
A Web Application Firewall (WAF) provides Layer 7 payload inspection capabilities to detect and drop SQL injection attempts in real time.
Standard network-level firewalls or deception systems (honeypots) do not function as inline application payload filters.

Anahtar Kavram

Network Security Alert Analysis and Application Layer Control Selection
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru