🔒AP Cybersecurity
1. The following sources all come from the same device (IP address 192.168.50.15) and were captured during a routine risk assessment. Use them to answer parts A through E.
Source 1 — Device Firewall Settings
Rule Number | Action | Source | Destination | Direction | Port Number | Protocol |
|---|---|---|---|---|---|---|
1 | Allow | 192.168.50.0/24 | 192.168.50.15 | Inbound | 22 | SSH |
2 | Allow | ALL | 192.168.50.15 | Inbound | 80 | HTTP |
3 | Allow | ALL | 192.168.50.15 | Inbound | 443 | HTTPS |
4 | Allow | ALL | 192.168.50.15 | Inbound | 21 | FTP |
5 | Allow | 192.168.50.15 | ALL | Outbound | 53 | DNS |
6 | Allow | 192.168.50.15 | ALL | Outbound | 80 | HTTP |
7 | Allow | 192.168.50.15 | ALL | Outbound | 443 | HTTPS |
8 | Allow | 192.168.50.15 | 10.0.0.50 | Outbound | 514 | Syslog |
9 | Deny | ALL | ALL | Inbound | ALL | ALL |
Source 2 — /home/admin/.bash_history
sudo tail -n 10 /home/admin/.bash_history
1 ls -la
2 cd /var/www/html/config
3 nano db_connect.php
4 systemctl restart nginx
5 ufw status numbered
6 ping -c 4 8.8.8.8
7 apt update
8 apt upgrade -y
9 top
10 clearSource 3 — /var/log/auth.log
sudo tail -n 14 /var/log/auth.log
1 Mar 14 08:15:01 web01 CRON[4102]: pam_unix(cron:session): session opened for user root
2 Mar 14 08:15:01 web01 CRON[4102]: pam_unix(cron:session): session closed for user root
3 Mar 14 09:22:10 web01 vsftpd[5021]: Failed login for invalid user admin from 203.0.113.88 port 21 ftp
4 Mar 14 09:22:11 web01 vsftpd[5023]: Failed login for invalid user root from 203.0.113.88 port 21 ftp
5 Mar 14 09:22:11 web01 vsftpd[5025]: Failed login for invalid user administrator from 203.0.113.88 port 21 ftp
6 Mar 14 09:22:12 web01 vsftpd[5027]: Failed login for invalid user webmaster from 203.0.113.88 port 21 ftp
7 Mar 14 09:22:13 web01 vsftpd[5029]: Failed login for invalid user test from 203.0.113.88 port 21 ftp
8 Mar 14 09:22:13 web01 vsftpd[5031]: Failed login for invalid user guest from 203.0.113.88 port 21 ftp
9 Mar 14 09:22:14 web01 vsftpd[5033]: Failed login for invalid user user from 203.0.113.88 port 21 ftp
10 Mar 14 09:22:15 web01 vsftpd[5035]: Failed login for invalid user info from 203.0.113.88 port 21 ftp
11 Mar 14 10:05:22 web01 kernel: [ 1234.567890] [UFW BLOCK] IN=eth0 OUT= MAC=00:11:22:33:44:55:66:77:88:99:aa:bb:08:00 SRC=198.51.100.42 DST=192.168.50.15 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=12345 PROTO=TCP SPT=49152 DPT=3306 WINDOW=65535 RES=0x00 SYN URGP=0
12 Mar 14 10:05:25 web01 kernel: [ 1237.123456] [UFW BLOCK] IN=eth0 OUT= MAC=00:11:22:33:44:55:66:77:88:99:aa:bb:08:00 SRC=198.51.100.42 DST=192.168.50.15 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=12346 PROTO=TCP SPT=49152 DPT=3306 WINDOW=65535 RES=0x00 SYN URGP=0
13 Mar 14 10:45:01 web01 sshd[6102]: Accepted publickey for admin from 192.168.50.22 port 54321 ssh2
14 Mar 14 10:45:01 web01 sshd[6102]: pam_unix(sshd:session): session opened for user admin by (uid=0)Source 4 — /var/log/nginx/access.log
sudo tail -n 10 /var/log/nginx/access.log
1 192.168.50.22 - - [14/Mar/2026:11:02:14 +0000] "GET / HTTP/1.1" 200 3421 "-" "Mozilla/5.0"
2 192.168.50.22 - - [14/Mar/2026:11:02:16 +0000] "GET /assets/style.css HTTP/1.1" 200 1024 "http://192.168.50.15/" "Mozilla/5.0"
3 192.168.50.22 - - [14/Mar/2026:11:02:18 +0000] "GET /ping.php HTTP/1.1" 200 850 "http://192.168.50.15/" "Mozilla/5.0"
4 198.51.100.77 - - [14/Mar/2026:11:15:22 +0000] "GET /ping.php?ip=127.0.0.1 HTTP/1.1" 200 912 "-" "curl/7.68.0"
5 198.51.100.77 - - [14/Mar/2026:11:15:25 +0000] "GET /ping.php?ip=127.0.0.1+%3B+cat+%2Fetc%2Fpasswd HTTP/1.1" 200 2145 "-" "curl/7.68.0"
6 198.51.100.77 - - [14/Mar/2026:11:15:28 +0000] "GET /ping.php?ip=127.0.0.1+%26%26+uname+-a HTTP/1.1" 200 1050 "-" "curl/7.68.0"
7 198.51.100.77 - - [14/Mar/2026:11:15:31 +0000] "GET /ping.php?ip=127.0.0.1+%7C+whoami HTTP/1.1" 200 870 "-" "curl/7.68.0"
8 198.51.100.77 - - [14/Mar/2026:11:15:35 +0000] "GET /ping.php?ip=127.0.0.1+%3B+id HTTP/1.1" 200 895 "-" "curl/7.68.0"
9 192.168.50.22 - - [14/Mar/2026:11:20:05 +0000] "GET /contact.php HTTP/1.1" 200 1540 "-" "Mozilla/5.0"
10 192.168.50.22 - - [14/Mar/2026:11:20:08 +0000] "POST /contact.php HTTP/1.1" 302 0 "http://192.168.50.15/contact.php" "Mozilla/5.0"Source 5 — ls -l /var/www/html/config
ls -l /var/www/html/config
total 24
-rw-r--r-- 1 admin www-data 1024 Mar 10 14:22 app_settings.ini
-rw-r--r-- 1 admin www-data 512 Mar 12 09:15 db_connect.php
-rw-r----- 1 admin www-data 2048 Mar 10 14:22 features.conf
-rwxr-x--- 1 admin www-data 850 Mar 11 11:05 run_backup.sh
-rw-r--r-- 1 admin www-data 120 Mar 10 14:22 routing.phpSource 6 — Acceptable Use Policy
Keep operating systems and software updated to the latest stable versions.
Use multi-factor authentication (MFA) for all administrative logins.
Connecting company-issued, encrypted removable media.
Accessing approved development and testing environments.
Installing unauthorized third-party software or scripts.
Modifying or disabling security controls, including host-based firewalls.
Consider the policy for the device in Source 6.
Explain how one part of the policy helps protect the device.
Explain how one rule in the current policy could be modified to make the device more secure. Include a specific example in your response.
In the authorization log, there is evidence of a password attack in rows 3–10.
Describe the evidence in the log file that indicates a password attack. Include specific entries from the log file in your response.
Identify the IP address of the adversary.
Consider all the sources from the device.
Explain how the permission settings for one file in the /var/www/html/config directory determine the level of access for that file for the owner, group, and all other users on the system. Include the name of the file in your response.
Other than removing all permissions from all users, describe one way the permission settings for one file on the system could be configured to restrict access for some users on the device. Include the name of the file in your response.
Using the explanation from part C (ii), write one or more chmod commands that set the permissions described.
Consider all the sources from the device.
Explain how one connection attempt on the device was blocked by the device’s firewall. Include evidence from a log file in your response.
Other than allowing all traffic for all services, describe a modification to one firewall rule that would allow the connection attempt identified in part D (i).
Other than allowing the connection attempt identified in part D (i), describe one impact of your modification from part D (ii) on incoming or outgoing network traffic on the device.
Apart from the password attack identified in part B, there is evidence of another attack on the device. Consider all the sources from the device.
Determine the type of attack evidenced in a log file.
Describe specific information in the log file that indicates the attack named in part E (i).
Describe one way an automated system could halt this type of attack in real time.
This attack could be mitigated by an automated system, such as a firewall, IDS, IPS, or AI. Identify a different countermeasure that could mitigate, prevent, or deter the attack.
