nerdexam
CompTIA

CAS-002 · Question #173

A security administrator is conducting network forensic analysis of a recent defacement of the company's secure web payment server (HTTPS). The server was compromised around the New Year's holiday…

The correct answer is C. The security administrator must reconfigure the network and place the IDS between the SSL. Because the SSL accelerator decrypts HTTPS traffic before it reaches the web servers, placing the IDS after the accelerator allows it to inspect plaintext traffic and detect attacks that are invisible to it in its current position.

Enterprise Security

Question

A security administrator is conducting network forensic analysis of a recent defacement of the company's secure web payment server (HTTPS). The server was compromised around the New Year's holiday when all the company employees were off. The company's network diagram is summarized below:

  • Internet
  • Gateway Firewall
  • IDS
  • Web SSL Accelerator
  • Web Server Farm
  • Internal Firewall
  • Company Internal Network

The security administrator discovers that all the local web server logs have been deleted. Additionally, the Internal Firewall logs are intact but show no activity from the internal network to the web server farm during the holiday. Which of the following is true?

Options

  • AThe security administrator should review the IDS logs to determine the source of the attack
  • BThe security administrator must correlate the external firewall logs with the intrusion
  • CThe security administrator must reconfigure the network and place the IDS between the SSL
  • DThe security administrator must correlate logs from all the devices in the network diagram to

How the community answered

(37 responses)
  • A
    22% (8)
  • B
    11% (4)
  • C
    62% (23)
  • D
    5% (2)

Why each option

Because the SSL accelerator decrypts HTTPS traffic before it reaches the web servers, placing the IDS after the accelerator allows it to inspect plaintext traffic and detect attacks that are invisible to it in its current position.

AThe security administrator should review the IDS logs to determine the source of the attack

Reviewing IDS logs in the current architecture is of limited value because the IDS only sees encrypted ciphertext and cannot detect application-layer attacks hidden inside SSL sessions.

BThe security administrator must correlate the external firewall logs with the intrusion

Correlating only external firewall logs with IDS logs is insufficient since the IDS cannot inspect encrypted content and the attack likely exploited an application-layer vulnerability invisible in firewall logs.

CThe security administrator must reconfigure the network and place the IDS between the SSLCorrect

The IDS currently sits before the SSL accelerator in the network path, meaning it only sees encrypted HTTPS traffic and cannot inspect the actual content of requests for malicious payloads. By repositioning the IDS between the SSL accelerator and the web server farm, it can analyze decrypted HTTP traffic and detect application-layer attacks. This architectural change is necessary to give the IDS visibility into the traffic actually reaching the secure web payment server.

DThe security administrator must correlate logs from all the devices in the network diagram to

Correlating all device logs is a useful investigative step but does not address the fundamental architectural flaw that prevented detection in the first place.

Concept tested: IDS placement relative to SSL decryption in network architecture

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-94.pdf

Topics

#network forensics#IDS placement#SSL accelerator#log correlation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice