セキュリティアナリストは、Webサーバーのログに以下のエントリを確認した。 200.17.88.121 [05/May/2025:01:05:18 -0200] " GET /aboutus.htm " 200 3344 200.17.88.121 [05/May/2025:01:08:22 -0200] " GET /corporateOrg.htm " 200 4200 132.18.62.144 [05/May/2025:01:08:23 -0200] " GET /../../vhosts " 403 502 200.17.88.121 [05/May/2025:01:10:33 -0200] " POST /ContactUs.asp " 403 512 118.19.200.55 [05/May/2025:01:10:45 -0200] " POST/search " 200 1212 " SELECT * FROM company WHERE keyword = ' VP 105.86.13.11 [05/May/2025:01:15:45 -0200] " GET /latestContracts.htm " 404 512 次のIPアドレスのうち、悪意のある試みに関与している可能性が最も高いのはどれですか?
正解:B
The malicious IP address is 118.19.200.55 because the log entry includes a SQL statement: SELECT * FROM company WHERE keyword = ' VP. That pattern strongly indicates an attempted SQL injection or database query manipulation through a web search endpoint. In Security+ threat and vulnerability analysis, SQL injection is an application attack in which an attacker places database commands into input fields or URL parameters to retrieve, alter, or destroy data. The 132.18.62.144 entry also shows suspicious directory traversal syntax using ../, but the question asks for the most likely malicious attempt among the listed entries; the explicit SQL query in a POST request is the clearest indicator. Normal GET requests and 404 errors alone are less conclusive.