312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ433

Logs and Network Forensics

During a late-night incident at an e-commerce site in Houston, Texas, analysts observe bursts of database errors and high time-taken values in IIS logs that align with requests in which attackers reportedly appended encoded input to the URL. To isolate and compare the exact payload strings against these spikes, which IIS W3C field should investigators parse?

  • A cs-uri-query
  • B cs-uri-stem
  • C sc-status
  • D cs-method
Explanation

The cs-uri-query field logs the URI query—the parameters appended to a URL—so it contains the encoded payload strings needed to correlate with error bursts and long request durations. cs-uri-stem contains the target path only, while sc-status and cs-method record the status code and HTTP verb. Configure Logging in IIS

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!