200-201 Question 308
Single answerA security analyst is investigating unusual activity on a web server. During the investigation, the analyst notices multiple unauthorized API calls being made to the server from an external IP address. The API calls include requests to initiate data exports and modify user permissions. What should be the analyst's immediate focus to mitigate this type of attack?
- A
Review the API logs to identify the source and scope of the unauthorized calls.
- B
Disable all API endpoints to prevent further unauthorized access.
- C
Update the web server's operating system to the latest version.
- D
Implement rate limiting and authentication mechanisms for the API.
Show answer and explanation
Correct answer: A
Explanation
The correct first step in responding to unauthorized API calls is to review the API logs to understand the scope and source of the activity. This allows the analyst to identify the attacker’s methods, determine what data or systems may have been compromised, and formulate an appropriate response without disrupting normal operations unnecessarily.
- A. Correct.
Reviewing the API logs is the immediate step to gather information about the unauthorized calls, such as the source, affected resources, and potential vulnerabilities. This step is critical for containment and further mitigation.
- B. Incorrect.
Disabling all API endpoints may disrupt legitimate operations and is not a practical immediate action unless the situation is extremely critical and cannot be controlled otherwise.
- C. Incorrect.
Updating the operating system is a good security practice but does not directly address the immediate issue of investigating and mitigating the unauthorized API calls.
- D. Incorrect.
Implementing rate limiting and authentication mechanisms is an effective long-term solution but does not address the immediate need to investigate and remediate the current unauthorized activity.