200-201 Question 226
Select 3You are a cybersecurity analyst reviewing IDS (Intrusion Detection System) logs after an unusual traffic spike on your network. You notice multiple alerts for a potential SQL injection attack originating from an external IP. Which of the following actions should you take to confirm and analyze the threat further?
- A
Review the payloads of the flagged packets to identify SQL injection patterns.
- B
Block the external IP address immediately using a firewall rule.
- C
Correlate the IDS logs with web server logs to identify potential exploitation attempts.
- D
Capture live traffic from the external IP using a packet sniffer for further analysis.
- E
Ignore the alerts if the IDS signature is known to generate false positives.
Show answer and explanation
Correct answers: A, C, D
Explanation
To analyze a potential SQL injection attack, it is important to confirm its validity by reviewing packet payloads for malicious patterns, correlating IDS logs with other log sources like web server logs, and, where necessary, capturing live traffic for further analysis. Immediate blocking or ignoring alerts without proper confirmation can lead to either disruption of legitimate traffic or overlooking real threats.
- A. Correct.
Reviewing the payloads of the flagged packets is crucial to confirm the presence of SQL injection attempts and understand the attack's nature.
- B. Incorrect.
Blocking the external IP address without further confirmation might lead to unnecessary disruptions, especially if the traffic is legitimate or the alert is a false positive.
- C. Correct.
Correlating IDS logs with web server logs can help identify whether the flagged activity corresponds to actual exploitation attempts or is merely noise.
- D. Correct.
Capturing live traffic from the external IP can provide deeper insights into the attacker's behavior and intentions, and help you verify the threat.
- E. Incorrect.
Ignoring the alerts outright without investigation is not a recommended practice, as it could lead to missing legitimate threats.