312-39V2: Certified SOC Analyst v2

By ECCouncil · Question Mode

QuestionQ52

VerifiedUnderstanding Cyber Threats, IoCs, and Attack Methodology

A healthcare organization’s SIEM identifies a series of unusual HTTP requests aimed at its patient portal. The requests come from a foreign IP address and take place outside business hours. The methods used are mainly TRACE and OPTIONS, which rarely appear in normal web traffic. The SIEM correlates these events with increased reconnaissance activity on other servers in the same subnet. What is the primary security concern associated with TRACE and OPTIONS requests?

Explanation

OPTIONS can reveal the HTTP methods supported by a server, often through the Allow response header. TRACE echoes the received request, including its headers. Together, these methods can expose server capabilities and request-header information that helps an attacker conduct reconnaissance.

Community Discussion

No comments yet. Be the first to start the discussion!