🔒AP Cybersecurity
12. The following sources all come from the same device (IP address 10.1.50.22, hostname dev-workstation) and were captured during a routine risk assessment. Use them to answer parts A through E.
Source 1 — Device Firewall Settings
Rule Number | Action | Source | Destination | Direction | Port Number | Protocol |
|---|---|---|---|---|---|---|
1 | Allow | ALL | 10.1.50.22 | Inbound | 80 | HTTP |
2 | Allow | ALL | 10.1.50.22 | Inbound | 443 | HTTPS |
3 | Allow | ALL | 10.1.50.22 | Inbound | 22 | SSH |
4 | Allow | ALL | 10.1.50.22 | Inbound | 23 | Telnet |
5 | Allow | 10.1.50.22 | ALL | Outbound | 53 | DNS |
6 | Allow | 10.1.50.22 | ALL | Outbound | 80 | HTTP |
7 | Allow | 10.1.50.22 | ALL | Outbound | 443 | HTTPS |
8 | Deny | ALL | ALL | Inbound | ALL | ALL |
Source 2 — /var/log/syslog
sudo tail -n 12 /var/log/syslog
1 Nov 14 08:15:01 dev-workstation CRON[4122]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
2 Nov 14 08:17:01 dev-workstation systemd[1]: Started Session 45 of user devuser.
3 Nov 14 08:20:05 dev-workstation systemd[1]: Starting Cleanup of Temporary Directories...
4 Nov 14 08:20:05 dev-workstation systemd[1]: systemd-tmpfiles-clean.service: Succeeded.
5 Nov 14 08:20:05 dev-workstation systemd[1]: Finished Cleanup of Temporary Directories.
6 Nov 14 08:25:01 dev-workstation CRON[4250]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
7 Nov 14 08:35:01 dev-workstation CRON[4311]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
8 Nov 14 08:45:01 dev-workstation CRON[4402]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
9 Nov 14 08:55:01 dev-workstation CRON[4515]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
10 Nov 14 09:05:01 dev-workstation CRON[4620]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
11 Nov 14 09:15:01 dev-workstation CRON[4733]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
12 Nov 14 09:25:01 dev-workstation CRON[4850]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)Source 3 — /var/log/auth.log
sudo tail -n 14 /var/log/auth.log
1 Nov 14 09:12:05 dev-workstation sshd[5021]: Accepted publickey for devuser from 10.1.50.5 port 51222 ssh2
2 Nov 14 09:12:05 dev-workstation sshd[5021]: pam_unix(sshd:session): session opened for user devuser by (uid=0)
3 Nov 14 09:14:10 dev-workstation kernel: [12345.678] [UFW BLOCK] IN=eth0 OUT= MAC=00:1A:2B:3C:4D:5E SRC=198.51.100.77 DST=10.1.50.22 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=42312 PROTO=TCP SPT=44321 DPT=3306 WINDOW=65535 RES=0x00 SYN URGP=0
4 Nov 14 09:15:01 dev-workstation login[5101]: FAILED LOGIN 1 FROM 203.0.113.88 FOR root, Authentication failure
5 Nov 14 09:15:03 dev-workstation login[5101]: FAILED LOGIN 2 FROM 203.0.113.88 FOR admin, Authentication failure
6 Nov 14 09:15:05 dev-workstation login[5101]: FAILED LOGIN 3 FROM 203.0.113.88 FOR devuser, Authentication failure
7 Nov 14 09:15:07 dev-workstation login[5101]: FAILED LOGIN 4 FROM 203.0.113.88 FOR test, Authentication failure
8 Nov 14 09:15:09 dev-workstation login[5101]: FAILED LOGIN 5 FROM 203.0.113.88 FOR guest, Authentication failure
9 Nov 14 09:15:11 dev-workstation login[5101]: FAILED LOGIN 6 FROM 203.0.113.88 FOR user, Authentication failure
10 Nov 14 09:15:13 dev-workstation login[5101]: FAILED LOGIN 7 FROM 203.0.113.88 FOR ubuntu, Authentication failure
11 Nov 14 09:15:15 dev-workstation login[5101]: FAILED LOGIN 8 FROM 203.0.113.88 FOR oracle, Authentication failure
12 Nov 14 09:15:17 dev-workstation login[5101]: FAILED LOGIN 9 FROM 203.0.113.88 FOR postgres, Authentication failure
13 Nov 14 09:15:19 dev-workstation login[5101]: FAILED LOGIN 10 FROM 203.0.113.88 FOR sysadmin, Authentication failure
14 Nov 14 09:18:22 dev-workstation sudo: devuser : TTY=pts/0 ; PWD=/home/devuser ; USER=root ; COMMAND=/usr/bin/apt updateSource 4 — /var/log/nginx/access.log
sudo tail -n 10 /var/log/nginx/access.log
1 10.1.50.5 - - [14/Nov/2026:09:18:45 +0000] "GET / HTTP/1.1" 200 1024 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
2 10.1.50.5 - - [14/Nov/2026:09:18:46 +0000] "GET /assets/style.css HTTP/1.1" 200 3411 "http://10.1.50.22/" "Mozilla/5.0"
3 10.1.50.5 - - [14/Nov/2026:09:18:46 +0000] "GET /assets/logo.png HTTP/1.1" 200 8912 "http://10.1.50.22/" "Mozilla/5.0"
4 198.51.100.77 - - [14/Nov/2026:09:20:01 +0000] "GET / HTTP/1.1" 200 1024 "-" "curl/7.68.0"
5 198.51.100.77 - - [14/Nov/2026:09:20:05 +0000] "GET /.env HTTP/1.1" 403 153 "-" "curl/7.68.0"
6 198.51.100.77 - - [14/Nov/2026:09:20:06 +0000] "GET /.git/config HTTP/1.1" 404 118 "-" "curl/7.68.0"
7 198.51.100.77 - - [14/Nov/2026:09:20:07 +0000] "GET /backup.zip HTTP/1.1" 404 118 "-" "curl/7.68.0"
8 198.51.100.77 - - [14/Nov/2026:09:20:08 +0000] "GET /admin/config.php HTTP/1.1" 401 210 "-" "curl/7.68.0"
9 198.51.100.77 - - [14/Nov/2026:09:20:09 +0000] "GET /api/keys HTTP/1.1" 404 118 "-" "curl/7.68.0"
10 10.1.50.5 - - [14/Nov/2026:09:22:15 +0000] "GET /dashboard HTTP/1.1" 200 4012 "http://10.1.50.22/" "Mozilla/5.0"Source 5 — ls -l /home/devuser/projects/webapp
ls -l /home/devuser/projects/webapp
-rw-r--r-- 1 devuser devteam 845 Nov 10 10:00 README.md
-rwxr-xr-x 1 devuser devteam 1024 Nov 12 14:30 build.sh
-rw-r--r-- 1 devuser devteam 1675 Nov 13 09:15 deploy_key.pem
-rw-r--r-- 1 devuser devteam 4096 Nov 14 08:22 main.py
-rw-r--r-- 1 devuser devteam 256 Nov 14 08:25 requirements.txt
drwxr-xr-x 2 devuser devteam 4096 Nov 10 10:05 assets
drwxr-xr-x 3 devuser devteam 4096 Nov 12 11:20 src
drwxr-xr-x 2 devuser devteam 4096 Nov 13 16:45 testsSource 6 — Acceptable Use Policy
Keep operating systems and software applications updated to the most recent version.
Lock workstation screens when left unattended.
Connect organization-approved external monitors and peripherals.
Access internal development servers via approved secure protocols.
Use unencrypted protocols for remote access or authentication.
Disable or bypass host-based firewalls and endpoint detection tools.
Store unencrypted private keys or credentials on shared drives or with open permissions.
Consider the policy for the device in Source 6.
Explain how one part of the policy helps protect the device.
Explain how one rule in the current policy could be modified to make the device more secure. Include a specific example in your response.
In the authorization log (Source 3), there is evidence of a password attack in rows 4–13.
Describe the evidence in the log file that indicates a password attack. Include specific entries from the log file in your response.
Identify the IP address of the adversary.
Consider all the sources from the device.
Explain how the permission settings for one file in the /home/devuser/projects/webapp directory determine the level of access for that file for the owner, group, and all other users on the system. Include the name of the file in your response.
Other than removing all permissions from all users, describe one way the permission settings for one file on the system could be configured to restrict access for some users on the device. Include the name of the file in your response.
Using the explanation from part C (ii), write one or more chmod commands that set the permissions described.
Consider all the sources from the device.
Explain how one connection attempt on the device was blocked by the device’s firewall. Include evidence from a log file in your response.
Other than allowing all traffic for all services, describe a modification to one firewall rule that would allow the connection attempt identified in part D (i).
Other than allowing the connection attempt identified in part D (i), describe one impact of your modification from part D (ii) on incoming or outgoing network traffic on the device.
Apart from the password attack identified in part B, there is evidence of another attack on the device. Consider all the sources from the device.
Determine the type of attack evidenced in a log file.
Describe specific information in the log file that indicates the attack named in part E (i).
Describe one way an automated system could halt this type of attack in real time.
This attack could be mitigated by an automated system, such as a firewall, IDS, IPS, or AI. Identify a different countermeasure that could mitigate, prevent, or deter the attack.
00:00
