Exam CS0-003 topic 1 question 419 discussion

Actual exam question from CompTIA's CS0-003

Question #: 419
Topic #: 1

An analyst reviews the following web server log entries:

%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd

No attacks or malicious attempts have been discovered. Which of the following most likely describes what took place?

A. A SQL injection query took place to gather information from a sensitive file.
B. A PHP injection was leveraged to ensure that the sensitive file could be accessed.
C. Base64 was used to prevent the IPS from detecting the fully encoded string.
D. Directory traversal was performed to obtain a sensitive file for further reconnaissance.

Show Suggested Answer

Suggested Answer: D 🗳️

by Justheretolook at May 23, 2025, 12:49 a.m.

Comments

Submit Cancel

Justheretolook

1 month ago

Selected Answer: D

The correct answer is: D. Directory traversal was performed to obtain a sensitive file for further reconnaissance. Explanation: • The string %2E%2E/%2E%2E/.../etc/passwd is URL-encoded for ../../../../../../etc/passwd, which is a classic directory traversal attack. This technique is used to access files outside the intended directory structure, such as system files (/etc/passwd in Unix/Linux systems). • The attacker is likely attempting to reconnoiter the system by accessing sensitive files, even if the attempt didn’t succeed.

upvoted 1 times

...