CompTIA CASP+ Practice Test

What type of attack is indicated by the log file entry from a web server during a security intrusion?

1. SQL injection

2. Cross-Site Scripting (XSS) attack

3. Denial of Service (DoS) attack

4. Command injection

The correct answer is: Cross-Site Scripting (XSS) attack

The log file entry indicating a Cross-Site Scripting (XSS) attack suggests that an attacker is injecting malicious scripts into content that will be delivered to other users. In this type of attack, the malicious code is executed in the browsers of users accessing the web application, which can lead to unauthorized actions being performed on behalf of those users, as well as the potential theft of sensitive information like cookies or session tokens. Typically, XSS attacks exploit the trust a user has in a particular site. They can occur when user inputs are not properly sanitized, allowing attackers to include scripts in input fields that are improperly handled by the server and subsequently displayed to other users. This is often seen in log files that contain suspicious input patterns, such as script tags or JavaScript events. In comparison, SQL injection involves manipulating database queries through input fields to access or modify data in the database improperly. A Denial of Service (DoS) attack is characterized by overwhelming a server with traffic to render it unable to respond to legitimate requests. Command injection targets operating system commands on the server, allowing an attacker to execute commands beyond the intended functionalities of the application.