CAS-003 · Question #813
A cybersecurity analyst receives a ticket that indicates a potential incident is occurring. There has been a large in log files generated by a generated by a website containing a `'Contact US''…
The correct answer is D. Running the website log files through a log reduction and analysis tool. The analyst's immediate task is to determine whether the spike in web traffic (and corresponding log volume) is from a legitimate marketing campaign or a potential attack such as a form-based spam/injection campaign. Running the logs through a log reduction and analysis tool…
Question
A cybersecurity analyst receives a ticket that indicates a potential incident is occurring. There has been a large in log files generated by a generated by a website containing a `'Contact US'' form. The analyst must determine if the increase in website traffic is due to a recent marketing campaign of if this is a potential incident. Which of the following would BEST assist the analyst?
Options
- AEnsuring proper input validation is configured on the `'Contact US'' form
- BDeploy a WAF in front of the public website
- CChecking for new rules from the inbound network IPS vendor
- DRunning the website log files through a log reduction and analysis tool
How the community answered
(36 responses)- A6% (2)
- B11% (4)
- C3% (1)
- D81% (29)
Explanation
The analyst's immediate task is to determine whether the spike in web traffic (and corresponding log volume) is from a legitimate marketing campaign or a potential attack such as a form-based spam/injection campaign. Running the logs through a log reduction and analysis tool (D) is the most direct approach: it aggregates, filters, and normalizes the large volume of log data to surface patterns - such as whether traffic originates from diverse legitimate IPs (consistent with marketing) or from a narrow set of IPs with automated patterns (consistent with an attack). Options A and B are preventive/defensive controls, not investigative tools. Option C checks for IPS signatures, which doesn't help differentiate marketing traffic from attacks.
Topics
Community Discussion
No community discussion yet for this question.