300-215 Question 184
Single answerWhile analyzing an NGINX access log for suspicious activity on a web application, you notice multiple entries with the same IP address repeatedly requesting the '/login' endpoint with varying usernames. Which type of malicious activity is most likely occurring, and what should you look for in the logs to confirm it?
- A
Brute force attack; check for many failed login attempts from the same IP address in a short time frame.
- B
SQL injection attack; check for unusual characters like single quotes or semicolons in the request URLs.
- C
Denial-of-service attack; check for a sudden surge in identical requests from multiple IP addresses.
- D
Cross-site scripting (XSS) attack; check for embedded JavaScript code in the HTTP requests.
Show answer and explanation
Correct answer: A
Explanation
The repeated '/login' requests from the same IP address strongly suggest a brute force attack, where an attacker is trying different username-password combinations. To confirm this, you should check for multiple failed login attempts in the log entries. Other attack types, such as SQL injection, denial-of-service, or XSS, do not align with the observed log pattern.
- A. Correct.
Correct. A brute force attack involves repeated attempts to guess a username-password combination. The repeated '/login' requests from the same IP in the logs suggest such activity. Failed login attempts in the log entries would confirm this.
- B. Incorrect.
Incorrect. SQL injection attacks typically target database queries through malicious input in parameters. Unusual characters in the URL may indicate SQL injection but are unrelated to repeated login attempts.
- C. Incorrect.
Incorrect. Denial-of-service attacks aim to overwhelm a server with requests, often from many IPs. A single IP repeatedly accessing '/login' does not match this pattern.
- D. Incorrect.
Incorrect. Cross-site scripting (XSS) involves injecting malicious JavaScript into a web application. This does not align with repeated login requests from the same IP.