312-49V11 · Question #132
A multinational company has recently fallen victim to a severe cyberattack. As part of the incident response team, you are analyzing the Apache web server logs to track the attacker s activities…
The correct answer is A. Apache modules: To uncover extended functionalities that may have been tampered with. Apache request processing behavior is commonly extended or altered through dynamically loaded modules (e.g., mod_security, mod_rewrite, custom modules). If HTTP.REQUEST handling appears changed, examining loaded/added/modified modules is the most direct way to find injected…
Question
A multinational company has recently fallen victim to a severe cyberattack. As part of the incident response team, you are analyzing the Apache web server logs to track the attacker s activities. You notice that modifications are made to the HTTP.REQUEST component of the Apache core, suggesting changes in request handling. To discern the type of modifications made, which of the following elements of the Apache web server architecture would you focus on examining?
Options
- AApache modules: To uncover extended functionalities that may have been tampered with
- Bhttp_protocol module: To identify the client and server data exchange details
- Chttp_config module: To check alterations in configuration files and modules management
- Dhttp_main module: To identify server startups and timeouts
How the community answered
(27 responses)- A78% (21)
- B7% (2)
- C11% (3)
- D4% (1)
Explanation
Apache request processing behavior is commonly extended or altered through dynamically loaded modules (e.g., mod_security, mod_rewrite, custom modules). If HTTP.REQUEST handling appears changed, examining loaded/added/modified modules is the most direct way to find injected functionality or tampering that affects request flow.
Topics
Community Discussion
No community discussion yet for this question.