A cloud security analyst is investigating the impact of a recent cyberattack. The analyst is reviewing the following information: Which of the following has occurred?

Question

Exhibit

Options

• AThe corporate administration page was defaced by the attacker.
• BA denial-of-service attack was successfully performed on the web server.
• CA new user was created on the web server by the attacker.
• DSensitive information from the corporate web server was leaked.

• A
  4% (1)
• B
  17% (4)
• C
  8% (2)
• D
  71% (17)

Explanation

The web server access log shows a GET request from 104.210.233.225 to the path "/../../../../conf/server.xml", which indicates a directory traversal attack. This type of attack allows an attacker to access sensitive files outside the intended directory structure, in this case, the server.xml configuration file, which may contain sensitive information such as credentials or system configurations. The web application firewall (WAF) log does not show any specific blocking actions, suggesting that the attack was successful in retrieving and potentially exfiltrating sensitive data from the corporate web server.

No community discussion yet for this question.