300-215 Question 126
Select 4A company’s security team has identified suspicious traffic on its network, originating from a web server within its environment. Upon investigation, it is determined that the server was compromised via an unpatched vulnerability in its web application. As the incident responder, which actions should you take to determine the attack vector and recommend mitigation strategies?
- A
Analyze the web server logs for unusual patterns and requests.
- B
Conduct a vulnerability scan on the web server to identify unpatched software.
- C
Immediately disable all outbound traffic from the compromised server to prevent further data exfiltration.
- D
Review recent application updates to determine if the vulnerability is newly introduced.
- E
Implement a Web Application Firewall (WAF) to block malicious requests targeting the application.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To effectively determine the attack vector and recommend mitigation strategies, it is important to analyze logs to understand the attack, perform a vulnerability scan to identify the exploited weakness, review application changes for context, and implement controls like a WAF to reduce the risk of similar attacks in the future. Disabling all outbound traffic is not a recommended step as it can disrupt operations and does not directly address the root cause.
- A. Correct.
Analyzing the web server logs helps identify the source and nature of the attack, including any malicious requests or patterns that exploited the vulnerability.
- B. Correct.
Conducting a vulnerability scan is critical to determine the specific unpatched vulnerability that was exploited, allowing for targeted mitigation.
- C. Incorrect.
Disabling all outbound traffic is reactive and may disrupt legitimate business operations. Instead, more targeted containment strategies should be considered.
- D. Correct.
Reviewing recent application updates can help identify whether the vulnerability was introduced through recent changes or if it has been present for a longer time.
- E. Correct.
Implementing a Web Application Firewall (WAF) provides an additional layer of protection by blocking known malicious requests, reducing the application’s attack surface.