B) Internal proxy is not correct. An internal proxy is a server that acts as an intermediary between internal clients and external servers. An internal proxy can provide various functions, such as caching, filtering, authentication, or encryption. An internal proxy can also generate logs with details regarding the client's requests, such as the source IP address, the destination URL, the protocol used, and the response received2. However, an internal proxy would not have logs with details regarding the threat actor's requests, as they are directed to the web application, not to the internal proxy.
C) TAXII server is not correct. TAXII stands for Trusted Automated eXchange of Intelligence Information, and it is a standard that defines how to exchange cyber threat intelligence (CTI) between different systems or organizations. TAXII uses a client-server model, where a TAXII client can request or send CTI to a TAXII server using predefined services and messages. A TAXII server can store and provide CTI in a structured and standardized format3. However, a TAXII server would not have logs with details regarding the threat actor's requests, as they are not related to CTI exchange.
D) Hardware security module is not correct. A hardware security module (HSM) is a physical device that provides secure storage and processing of cryptographic keys and operations. An HSM can protect sensitive data and transactions, such as encryption, decryption, signing, or verification, from unauthorized access or tampering. However, an HSM would not have logs with details regarding the threat actor's requests, as they are not related to cryptographic operations.
1: What Is a Cloud-Based Web Application Firewall (WAF)? 2: What Is a Proxy Server? 3: What Is TAXII? : [What Is a Hardware Security Module (HSM)?] Explanation:
The correct answer is A. Cloud WAF. A cloud WAF stands for a cloud-based web application firewall, and it is a service that protects web applications from common attacks, such as SQL injection, cross-site scripting, or denial-of-service. A cloud WAF can inspect and filter HTTP requests and responses between the web application and the internet, and block or allow them based on predefined or custom rules. A cloud WAF can also generate logs with details regarding the threat actor's requests, such as the source IP address, the destination URL, the payload, the rule triggered, and the action taken1.