300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

Question

Question Image

Refer to the exhibit. Which two conclusions should be made about the attack from the Apache access logs?

Choose two

A The attacker used r57 exploit to elevate their privilege.
B The attacker uploaded the word press file manager trojan.
C The attacker performed a brute force attack against word press and used sql injection against the backend database.
D The attacker used the word press file manager plugin to upoad r57.php.
E The attacker logged on normally to word press admin page.

Explanation

The access sequence records a successful WordPress login followed by installation and activation of the File Manager plugin. Requests to wp-content/r57.php afterward indicate that r57.php was uploaded through that plugin and accessed. The successful authentication and access to wp-admin show normal login to the WordPress administrative area.

300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

AstroTutor

Notes

Readiness

QuestionQ6

Community Discussion