nerdexam
CompTIA

CAS-003 · Question #813

A cybersecurity analyst receives a ticket that indicates a potential incident is occurring. There has been a large in log files generated by a generated by a website containing a `'Contact US''…

The correct answer is D. Running the website log files through a log reduction and analysis tool. The analyst's immediate task is to determine whether the spike in web traffic (and corresponding log volume) is from a legitimate marketing campaign or a potential attack such as a form-based spam/injection campaign. Running the logs through a log reduction and analysis tool…

Enterprise Security Operations

Question

A cybersecurity analyst receives a ticket that indicates a potential incident is occurring. There has been a large in log files generated by a generated by a website containing a `'Contact US'' form. The analyst must determine if the increase in website traffic is due to a recent marketing campaign of if this is a potential incident. Which of the following would BEST assist the analyst?

Options

  • AEnsuring proper input validation is configured on the `'Contact US'' form
  • BDeploy a WAF in front of the public website
  • CChecking for new rules from the inbound network IPS vendor
  • DRunning the website log files through a log reduction and analysis tool

How the community answered

(36 responses)
  • A
    6% (2)
  • B
    11% (4)
  • C
    3% (1)
  • D
    81% (29)

Explanation

The analyst's immediate task is to determine whether the spike in web traffic (and corresponding log volume) is from a legitimate marketing campaign or a potential attack such as a form-based spam/injection campaign. Running the logs through a log reduction and analysis tool (D) is the most direct approach: it aggregates, filters, and normalizes the large volume of log data to surface patterns - such as whether traffic originates from diverse legitimate IPs (consistent with marketing) or from a narrow set of IPs with automated patterns (consistent with an attack). Options A and B are preventive/defensive controls, not investigative tools. Option C checks for IPS signatures, which doesn't help differentiate marketing traffic from attacks.

Topics

#log analysis#incident triage#web traffic#log reduction

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice