CAS-003 · Question #167
A security manager looked at various logs while investigating a recent security breach in the data center from an external source. Each log below was collected from various security devices compiled…
The correct answer is B. Log 2 E. Buffer overflow. Log 2 indicates that the security breach originated from an external source. And the vulnerability that can be associated with this security breach is a buffer overflow that happened when the amount of data written into the buffer exceeded the limit of that particular buffer.
Question
A security manager looked at various logs while investigating a recent security breach in the data center from an external source. Each log below was collected from various security devices compiled from a report through the company's security information and event management server. Logs:
Log 1:
Feb 5 23:55:37.743: %SEC-6-IPACCESSLOGS: list 10 denied 10.2.5.81 3 packets Log 2:
aaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Log 3:
Security Error Alert Event ID 50: The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client Log 4:
Encoder oe = new OracleEncoder (); String query = "Select user_id FROM user_data WHERE user_name = " + oe.encode ( req.getParameter("userID") ) + " and user_password = " + oe.encode ( req.getParameter("pwd") ) +" "; Vulnerabilities Buffer overflow SQL injection ACL XSS Which of the following logs and vulnerabilities would MOST likely be related to the security breach? (Select TWO).
Options
- ALog 1
- BLog 2
- CLog 3
- DLog 4
- EBuffer overflow
- FACL
- GXSS
- HSQL injection
How the community answered
(44 responses)- A23% (10)
- B57% (25)
- D2% (1)
- F2% (1)
- G11% (5)
- H5% (2)
Explanation
Log 2 indicates that the security breach originated from an external source. And the vulnerability that can be associated with this security breach is a buffer overflow that happened when the amount of data written into the buffer exceeded the limit of that particular buffer.
Topics
Community Discussion
No community discussion yet for this question.