200-201 Question 345
Select 3A security analyst is monitoring a network using an intrusion detection system (IDS). The IDS generates an alert indicating a potential SQL injection attempt targeting a web application. What should the analyst do next to validate the authenticity of this alert?
- A
Review the web server logs for evidence of SQL injection activity.
- B
Update the IDS signatures to prevent future SQL injection attempts.
- C
Analyze the payload of the suspected SQL injection to determine its intent.
- D
Immediately block the IP address of the suspected attacker.
- E
Verify if the web application has any existing vulnerabilities to SQL injection.
Show answer and explanation
Correct answers: A, C, E
Explanation
When an IDS generates an alert, the analyst must validate its authenticity before taking further action. Reviewing server logs, analyzing the payload, and assessing application vulnerabilities are essential steps to confirm whether the alert is legitimate. Actions like updating IDS signatures or blocking IP addresses should only occur after proper validation to avoid unnecessary disruptions or overlooking the root cause.
- A. Correct.
Reviewing web server logs helps to cross-check if the suspected SQL injection attempt is logged, providing evidence of the attack and its context.
- B. Incorrect.
Updating IDS signatures is a reactive step that should be taken after confirming the incident and analyzing the attack, not as an immediate response to an alert.
- C. Correct.
Analyzing the payload allows the analyst to understand whether the alert correlates with a legitimate SQL injection attempt or a false positive.
- D. Incorrect.
Blocking an IP address without confirmation could result in blocking legitimate traffic and should only be performed after validating the threat.
- E. Correct.
Verifying if the web application has vulnerabilities to SQL injection helps determine if the attack could exploit the system, providing further validation of the alert.