Exam CS0-003 topic 1 question 67 discussion

Do we know what the odd characters are indicative of yet? Is this an attack? We need to investigate and determine if this is an incident first before we consult an attack framework.

Y'all need to quit using ChatGPT. The correct choice is C. NOT A) You can't just shut down an entire network. It hasn't been confirmed to be malicious. This is not a good containment practice. NOT B) This is part of the incident analysis process. This just tells you what kind of attack it may be. Your attack framework would be able to identify this better (option C). C. Is correct. Your attack response framework (Kill Chain, MITRE, DIAMOND) will guide your response, and from there, you would begin your incident response, which will include option B and D by the way. You don't just willy nilly take whatever response approach you wish to. Your framework will guide your response. NOT D) It's not always necessary if you are not regulated. Also, this part of incident response process. Option C would include this and is a better option.

Incident response doesn’t make sense, they use the word “odd”, it could be benign activity that the analyst just isn’t familiar with.

Follow the guidelines and the standard operating procedures.

the correct response is B; typically, when we have suspicions, we need to investigate further to confirm whether there is a real attack before starting the incident response plan

I go for C

I’d choose B cause how can you determine what incident response will consist of if you don't even know what type of attack it is first? I get why ppl picked C but still

Essa escolha permite uma abordagem organizada e abrangente, garantindo que o tipo de ataque seja identificado e que os passos apropriados para mitigação e resposta sejam seguidos de acordo com as melhores práticas de segurança.

Honestly, C is the only one that makes logical sense... choose c... trust me, scored an 827 on my exam

Analyzing the odd characters in the request line can help determine if they are part of a known attack pattern or if they indicate malicious activity. This step involves investigating the nature of the characters, such as whether they resemble SQL injection attempts, cross-site scripting (XSS) payloads, or other types of injection attacks. Once the nature of the attack is identified, appropriate response actions can be taken, such as implementing security controls to mitigate the attack, blocking malicious IP addresses, or patching vulnerable systems. Options A, C, and D are not suitable as immediate next steps without first understanding the nature and severity of the incident through analysis.

...............

How can you determine what incident response will consist of if you don't even know what type of attack it is first, if it is even an attack at all and not just a false positive?

B. Determine what attack the odd characters are indicative of. In the context of reviewing web server logs, the most immediate and practical step is to investigate the nature of the odd characters in the request line. This involves understanding the patterns, syntax, and characteristics of these entries to determine if they are indicative of a particular attack or anomaly. Simply shutting down the network (option A) or notifying law enforcement (option D) without understanding the nature of the issue might be premature and could disrupt normal operations unnecessarily. Utilizing the correct attack framework (option C) may come into play after identifying the attack type, but the initial focus should be on understanding the nature of the odd characters to assess the potential threat.

Gonna go against the grain here and say C. Why waste your time figuring out what the symbols are when you may already have a plan that tells you what to do if you see odd symbols in your web server logs?

agree with option B. odd characters on web server logs could be double encoding or obfuscation technique to conceal the actual payload. analyst may want to find out whether the attacker was successful or could be false-positive. in any case, i think more information in needed in order to navigate any attack framework.

I go for C

From Chatgpt: You're correct; option C suggests a more comprehensive approach that involves utilizing the correct attack framework and determining the incident response plan. This step includes both understanding the nature of the attack (similar to option B) and planning the appropriate response to mitigate the impact and prevent further damage.