Exam SY0-701 topic 1 question 452 discussion

D. Check the users table for new accounts. Here's why: SQL injection can lead to unauthorized database access and modifications, such as creating new user accounts. By checking the users table for any suspicious or unauthorized accounts, the analyst can quickly identify if the attack succeeded and take immediate action to remove or disable those accounts.

Remember the 7 step process: preparation, detection, analysis, containment, eradication, recovery, lessons learned. The security analyst detected the issue in the question prompt, the next step is analyze (check if new user was created).

1.Attacks are being launched via query.php (apparent SQL Injection attempt) 2.The attack path should be blocked immediately to prevent data corruption or further infiltration. 3.Disabling the script immediately terminates the attack surface and is part of the "containment phase" of the incident response process.

D. Check the users table for new accounts. This step will provide immediate insight into whether the incident has led to unauthorized access or account creation, allowing for a more informed response to the situation

The second log entry shows a potential SQL injection attack where the request contains the string: sql Copy code 123 INSERT INTO users VALUES ('temp', 'pass123')# This suggests that the attacker is attempting to insert a new record into the "users" table by exploiting a vulnerability in the query.php script. The first step the security analyst should take is to check the users table for any new accounts that might have been created during the attack.

Best immediate action: disable the query.php script