AP Cybersecurity Drill 28: Anomalies in a Web Access Log

Question 1. How many distinct source IP addresses appear in the log excerpt?

• A) Two distinct source IP addresses appear in the log excerpt
• B) Three distinct source IP addresses appear in the log excerpt
• C) Four distinct source IP addresses appear in the log excerpt ✓
• D) Five distinct source IP addresses appear in the log excerpt

Explanation: Choice C is correct. The distinct addresses are 198.51.100.7, 198.51.100.18, 198.51.100.23, and 198.51.100.31, which is four; the .7 and .18 addresses each appear more than once but still count once. Choice A is incorrect because there are more than two distinct addresses. Choice B is incorrect because counting three overlooks one of the four distinct addresses. Choice D is incorrect because five over-counts; only four distinct addresses are present.

Question 2. The requests to /account include the text id=1001 followed by OR '1'='1 and return status 500. Which activity does this pattern most clearly suggest?

• A) A staff member who is running a routine report against the internal customer database
• B) A search-engine crawler indexing the store's public product catalog pages
• C) A customer accidentally mistyping an account number into the search box
• D) An attempt to inject SQL into the account lookup so the query returns extra rows ✓

Explanation: Choice D is correct. Appending OR '1'='1 to a parameter is a classic SQL injection probe meant to make the database query always true and return rows the request should not see; the server errors (500) suggest the input reached the query. Choice A is incorrect because a routine staff report would not send injection text in the URL. Choice B is incorrect because a crawler requests normal page paths, not crafted query conditions. Choice C is incorrect because a mistyped number would not contain SQL operators like OR '1'='1.

Question 3. Reading the status codes, which request was refused by the server rather than processed or returned as an error?

• A) The /products?id=42 request, because returning status 200 means it was served
• B) The first /account request, because returning status 500 means it was refused outright
• C) The /products?id=44 request, because it came from a source address not seen earlier
• D) The /admin/export request, because returning status 403 means the server denied access ✓

Explanation: Choice D is correct. Status 403 means the server understood the /admin/export request but refused to authorize it, so it was rejected rather than served. Choice A is incorrect because status 200 means the products request succeeded, not that it was refused. Choice B is incorrect because status 500 is a server error during processing, not a refusal. Choice C is incorrect because that products request returned 200 and was served; a new source address does not mean it was refused.

Question 4. Comparing the log to the baseline note, why is the /admin/export request from 198.51.100.23 worth investigating even though it returned 403?

• A) An outside address reached a staff-only path at all, showing the path is exposed enough to receive and deny external requests ✓
• B) A 403 status here means the attacker has already obtained valid administrator credentials
• C) The export path runs more slowly than product pages, so it likely degraded performance
• D) Returning 403 proves the request was completely harmless and needs no further review

Explanation: Choice A is correct. The baseline says /admin is for internal staff only, so a request from a source other than the expected internal network reaching that path at all shows the admin area is exposed more broadly than intended, even though this attempt was refused. Choice B is incorrect because a 403 indicates the request was denied, not that valid credentials were held. Choice C is incorrect because nothing in the log concerns performance. Choice D is incorrect because a denied probe of a staff-only path is exactly the kind of event that warrants review, not dismissal.

Question 5. Given the injection-style requests in the log, which response best both detects and reduces this kind of attack going forward?

• A) Tell customers to choose much longer and more complex passwords for their store accounts
• B) Block the single source address 198.51.100.18 and then consider the whole issue resolved
• C) Use parameterized queries for the account lookup and alert on injection-style input ✓
• D) Lower the server's logging level so the many recurring status 500 errors stop filling the log

Explanation: Choice C is correct. Parameterized queries keep user input from being treated as part of the SQL command, which removes the underlying weakness, and alerting on injection-style input detects future attempts. Choice A is incorrect because password length does not address an injection flaw in how queries are built. Choice B is incorrect because blocking one address does not fix the vulnerability and an attacker can return from another address. Choice D is incorrect because hiding the 500 errors removes the very evidence needed to detect the attack.