An analyst is looking at Web Server logs, and sees the following entry as the last web request that a server processed before unexpectedly shutting down: 147.186.119.107 - - [28/Jul/2006:10:27:10…

Question

Options

• ADistributed denial of service attack.
• BDenial of service attack.
• CDatabase injection attack.
• DCross-Site scripting attack.

• A
  24% (7)
• B
  59% (17)
• C
  10% (3)
• D
  7% (2)

Explanation

Option B is correct because a single IP address (147.186.119.107) sent a POST request to /cgi-bin/shutdown/, which successfully executed (HTTP 200) and caused the server to go offline - a classic single-source denial of service where one attacker makes a resource unavailable.

A (DDoS) is wrong because a distributed attack involves multiple source IPs overwhelming a target simultaneously; only one IP appears in this log entry.

C (Database injection) is wrong because SQL/database injection targets query parameters to manipulate a backend database - there are no query strings or database-bound inputs here, just a CGI endpoint that triggers a system action.

D (Cross-Site Scripting) is wrong because XSS injects malicious scripts into web pages to attack other users' browsers, not to shut down the server itself.

Memory tip: Think "one attacker, one victim server = DoS; many attackers, one victim = DDoS." The /cgi-bin/shutdown/ path is the smoking gun - an attacker found and triggered an exposed administrative endpoint, which is a DoS via unauthorized command execution rather than traffic flooding.

No community discussion yet for this question.