Exam SPLK-5001 topic 1 question 13 discussion

Actual exam question from Splunk's SPLK-5001

Question #: 13
Topic #: 1

Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server’s access log has the same log entry millions of times:
147.186.119.200 - - [28/Jul/2023:12:04:13 -0300] "GET /login/ HTTP/1.0" 200 3733
What kind of attack is occurring?

A. Denial of Service Attack
B. Distributed Denial of Service Attack
C. Cross-Site Scripting Attack
D. Database Injection Attack

Show Suggested Answer

Suggested Answer: A 🗳️

by ProfessorJayy at Aug. 31, 2024, 12:02 a.m.

Comments

Submit Cancel

CeeCapi

7 months, 2 weeks ago

A. Denial of Service Attack The repeated identical log entry suggests a Denial of Service (DoS) attack, where a single source floods the server with requests to make it unavailable to legitimate users. Since there is no indication of multiple IP addresses, it is likely a DoS rather than a Distributed Denial of Service (DDoS) attack, which would involve multiple sources.

upvoted 1 times

...

Nss_dfir

8 months, 1 week ago

Selected Answer: A

A. Denial of Service Attack. This suggests that the web server is being overwhelmed by repeated requests from a single source (the IP address 147.186.119.200), which can lead to the server becoming unavailable to legitimate users. If the attack were coming from multiple sources, it would be classified as a Distributed Denial of Service (DDoS) attack, but in this case, the log indicates a single source.

upvoted 2 times

...

ProfessorJayy

9 months, 2 weeks ago

Selected Answer: A

only one ip, DoS?

upvoted 2 times

...