A healthcare organization's SIEM detects unusual HTTP requests targeting its patient portal. The requests originate from a foreign IP address and occur during non-business hours. The methods used…

Question

Options

• AThey expose information about server-supported methods and request headers
• BThey can be used to upload malicious payloads directly to the server
• CThey make Distributed Denial of Service (DDoS) attacks easier
• DThey allow attackers to bypass authentication controls

• A
  80% (20)
• B
  12% (3)
• C
  4% (1)
• D
  4% (1)

Explanation

TRACE and OPTIONS are often associated with reconnaissance because they can reveal how a server is configured and what capabilities it supports. OPTIONS can disclose which HTTP methods are allowed (GET, POST, PUT, DELETE, etc.), helping attackers identify whether risky methods are enabled or misconfigured. TRACE can be abused to reflect request headers back to the client, which may expose sensitive header information in certain misconfigurations and historically has been associated with cross-site tracing risks. In SOC investigations, unusual usage of TRACE/OPTIONS-especially before selecting an exploit path. Uploading payloads is more associated with PUT/POST to vulnerable endpoints, not primarily TRACE/OPTIONS. DDoS facilitation is not a primary characteristic of these methods. Authentication bypass is not an inherent feature of TRACE/OPTIONS; attackers still need a separate vulnerability to bypass auth. Because the question asks for the primary concern, the best answer is that these methods can reveal supported methods and header behavior, increasing attacker knowledge and enabling follow-on exploitation attempts.

No community discussion yet for this question.