A security engineer needs to analyze Apache web server access logs that are stored in an Amazon S3 bucket. Amazon EC2 instance web servers generated the logs. The EC2 instances have the Amazon…

Question

Options

• ASELECT client_ip, client_request FROM logs WHERE client_request LIKE '%/admin%!' AND
• BSELECT client_ip FROM logs WHERE client_request CONTAINS '%/admin%' AND server_status
• CSELECT DISTINCT (client_ip), client_request, client_id FROM logs WHERE server status = `403'
• DSELECT DISTINCT (client_ip), client_request FROM logs WHERE user_id <> `admin' AND

• A
  83% (25)
• B
  7% (2)
• C
  3% (1)
• D
  7% (2)

Explanation

This query identifies the IP addresses (client_ip) that attempted to access restricted content (i.e., the /admin URL path) by checking the field for requests that contain /admin. The query also filters by server_status = '403', which indicates that the access was forbidden (meaning the request was made but access was denied, typically due to permission issues). The query retrieves both the client_ip (to identify the source of the failed attempts) and client_request (to identify the URLs that the IPs attempted to access). This approach directly satisfies the requirement to find failed access attempts to the /admin URL path and the associated attempted URLs.

No community discussion yet for this question.