Câu 37: 312-39V2: Certified SOC Analyst (CSA) v2

Following a high-priority security incident, you, as an Incident Responder of a Cyber Incident Response firm, initiate an internal investigation after reports confirm that serious data breach in which sensitive customer data, including payment details and personal information, was stolen from a critical web server. You begin analyzing the server logs to reconstruct the attack timeline and identify how the attacker gained access. During your investigation, you discover suspicious activity in the logs, including repeated requests attempting to access files and directories outside of the web server's root directory. Some of these requests appear to be manipulating URL paths to navigate into restricted system files – a behavior that is often associated with web-based exploits. You suspect that a vulnerability in the web server was exploited to bypass security restrictions and access unauthorized directories, potentially exposing sensitive configurations and credentials. However, they still need to confirm the exact technique used to perform this attack. Which type of web application attack might have caused this incident?

1. A. SQL Injection Attack
2. B. Directory Traversal — đáp án hiện tại
3. C. Cross-site Scripting (XSS) Attacks
4. D. Session Attacks: Cookie Poisoning Attacks