300-215 Question 181
Single answerDuring an incident investigation, you are analyzing NGINX web server logs to identify potential malicious activity. You observe the following log entry: '192.168.1.10 - - [12/Oct/2023:10:15:34 +0000] "GET /admin HTTP/1.1" 200 560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"'. What can you infer from this log entry?
- A
The client at IP address 192.168.1.10 accessed a sensitive endpoint that may require further investigation.
- B
The request was unsuccessful since the HTTP status code indicates a client error.
- C
The user agent string suggests that this request originated from a mobile device.
- D
The log entry indicates that the /admin endpoint was accessed without any referrer information.
Show answer and explanation
Correct answer: A
Explanation
This log entry provides key details about a request to the /admin endpoint, including the IP address of the client, the HTTP method (GET), and the user agent. The /admin endpoint is often a sensitive resource in web applications, and access to it requires further investigation to ensure it was authorized. The HTTP status code 200 confirms the request was successful. While the absence of a referrer ('-') is an interesting detail, it is secondary to the critical observation regarding the sensitive endpoint.
- A. Correct.
This is correct. The IP address 192.168.1.10 accessed the /admin endpoint, which might be sensitive and could require further analysis for potential unauthorized access.
- B. Incorrect.
This is incorrect. The HTTP status code 200 indicates a successful request, not a client error.
- C. Incorrect.
This is incorrect. The user agent string indicates a request from a Windows desktop environment, not a mobile device.
- D. Incorrect.
This is partially correct but not the best answer. While the absence of a referrer ('-') is notable, it does not provide the key insight into the sensitivity of the accessed endpoint.