Question 34

Directory traversal

The observed behavior in the SIEM alerts demonstrates a directory traversal attack, where the attacker manipulates the file paths to access restricted directories and files on the server, such as '/etc/passwd'.

A) Credential replay

Credential replay refers to the unauthorized use of valid user credentials to gain access to a system. In this case, the behavior observed does not involve the reuse of credentials but rather attempts to access system files through crafted URL parameters, making this option incorrect.

B) Directory traversal

This option accurately describes the behavior observed in the alerts. The patterns in the URLs indicate that the attacker is attempting to navigate the file system hierarchy by using '../' sequences to access sensitive files, specifically targeting '/etc/passwd', which is a well-known file containing user account information on Unix-like systems.

C) Brute-force attack

A brute-force attack involves systematically trying a large number of combinations to gain unauthorized access to accounts or systems. The behavior observed does not involve attempting to guess passwords or keys but is focused on manipulating file paths, thus making this option incorrect.

D) Resource exhaustion

Resource exhaustion attacks aim to deplete system resources, such as CPU or memory, by overwhelming the system with requests. The activity seen in the alerts does not relate to exhausting resources but rather attempts to read sensitive data through directory traversal, which makes this option inappropriate.

Conclusion

The correct answer is directory traversal, as it directly relates to the method of accessing restricted files by manipulating the file path. All other options fail to explain the observed behavior, which centers around accessing system files rather than credential misuse, guesswork, or resource depletion.