How Do You Identify the Source IP and IoC in a Website Defacement?
Short answer
Source IP 41.21.18.102; IoC is the modified /var/www/index.html; corrective actions are change the sjames password and block external SFTP access.
Question
An organization’s website was maliciously altered.
INSTRUCTIONS
Review information in each tab to select the source IP the analyst should be concerned about, the indicator of compromise, and the two appropriate corrective actions.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Key Takeaways
The exam tests log correlation: the malicious change follows the successful external login from 41.21.18.102 and writes /var/www/index.html, so distractors like a single failed login or TCP TIME_WAIT entries are not the primary IoC.
This CS0-003 simulation asks the analyst to correlate web-server and SFTP logs after a website defacement, pick the offending source IP and IoC, then choose containment actions. The page establishes 41.21.18.102 as the external actor, modified index.html as the evidence, and password reset plus external SFTP blocking as fixes.
Common mistake: Learners often chase the single failed login or the multiple TCP TIME_WAIT connections as the compromise signal, instead of tying the external successful login to the actual index.html write and then choosing containment that revokes the compromised account and exposure.
Expert Analysis
Why the Answer Is Correct
The incident statement says the website was maliciously altered, so the analyst must find the external session that actually wrote the web content. In the exhibits, 41.21.18.102 authenticates as sjames and then the session changes into /var/www and writes index.html; that direct write is the defacement, not mere login noise. The same account also appears with a private address, indicating credential misuse from an external source rather than a normal internal admin action. Therefore the source IP is 41.21.18.102, the IoC is the modified /var/www/index.html file, and the corrective actions must revoke the compromised sjames credential and close external SFTP exposure.
Why Other Candidate Answers Are Wrong
32.111.16.37 is a distractor because it shows only one failed login after a prior successful login, which is more consistent with a typo or isolated failed attempt than a brute-force or defacement source. Choosing TCP TIME_WAIT entries as the IoC ignores the actual file write and mistakes normal connection teardown for malicious activity. A private/internal address is also a weaker source-IP choice when the evidence ties the unauthorized index.html modification to the external 41.21.18.102 session. Corrective-action distractors that only restore the web page, block a single IP, or leave sjames and external SFTP usable do not address the compromised credential and access path.
Community Comment Notes
TommyZ focused on the wording "website was maliciously altered" and tied it to the 41.x login that modifies index.html, which matches the direct evidence. Popeyes_Chicken questioned 32.111.16.37 because there is only one failed attempt after a successful login and the TIME_WAIT connections may be legitimate, while noting the modification happened right after 41.21.18.102 authenticated. 7167087 and 7b52438 reached the same practical set: 41.21.18.102, modified index.html, change the sjames password, and block external SFTP access. taketaa added that sjames is logged in from both a private and a public address and that the 41 address remains logged in, reinforcing the need to evict the session.
Exam Strategy
Read the incident statement first: 'website was maliciously altered' tells you to find the successful external login that wrote the web root, not every suspicious log line. For corrective actions, pick containment that removes the credential and access path used, not just cosmetic restoration.
Frequently Asked Questions
Why is 41.21.18.102 the source IP rather than 32.111.16.37 in this website defacement simulation?
Which corrective actions should be selected for the modified index.html incident?
Discussion 10 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 10
-
TommyZ 👍 14Main point is what 7167087 said. "website was maliciously altered" IP 41 logs in and modifies the index.html file which is what the question states. So IP 41. Modified Index.html file. Change the password Block external sftp access I'm taking the exam tomorrow and that's what I'm going with. This question was just posted a week ago. Expecting to get it. Wish me luck 🤞
-
Popeyes_Chicken 👍 10I think the source IP is incorrect. 32.111.16.37 shows one failed login attempt after a previous successful login. I don't see any indicator of a brute force attempt, the failed attempt was probably a typo. The multiple tcp time wait connections may have been legitimate activity. The modification happened directly after 41.21.18.102 authenticated successfully. Thoughts?
-
7167087 👍 8I believe it's the 41. address that is the malicious source IP address. The question is about the website being maliciously modified. The 41. address modifies the index file as an external address and has an existing connection.
-
7b52438 👍 2TommyZ is correct : Source IP: 41.21.18.102 Indicator of compromise: Modified index.html file Corrective actions: -Change the password on the sjames account -Block external SFTP access
-
taketaa 👍 2yeah, I'm think the same, sjames is both logged on a private AND a public IP address. 41 IP address is the malicious source, and it is still logged in to the machine!
Show 5 more comments
-
Popeyes_Chicken 👍 2Good luck! Check back in if you see this to let us know how things went! I'll be taking it next week =]
-
Wolf541 👍 2How did your exam go I am taking mine in a few days?
-
agfencer 👍 141.21.18.102 23:02:25, this connection changes to the web directory (/var/www) and executes a file modification: [./index.html written]. This is the malicious alteration This is the specific external IP address that successfully gained access via the compromised account and directly wrote the unauthorized changes to the web configuration file indicator of compromise > Modified index.html file Select the corrective actions (Select TWO): Change the password on the sjames account Block external sftp access (incident containment tactic to shut down external exposure vectors to structural backend server file paths while the forensic investigation wraps up)
-
tailogdavid1987 👍 1Source IP of most concern: 41.21.18.102 Indicator of compromise: Modified index.html file Corrective actions: Change the password on the sjames account and Block external sftp access
-
PatrickH 👍 1It is the 41 address. It was logged it at 23:00 and the login attemt directly afterwards was unsuccessful.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.