How Do You Identify the Source IP and IoC in a Website Defacement?
SIMULATION
An organization’s website was maliciously altered.
INSTRUCTIONS
Review information in each tab to select the source IP the analyst should be concerned about, the indicator of compromise, and the two appropriate corrective actions.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Community Insight
The exam tests log correlation: the malicious change follows the successful external login from 41.21.18.102 and writes /var/www/index.html, so distractors like a single failed login or TCP TIME_WAIT entries are not the primary IoC.
This CS0-003 simulation asks the analyst to correlate web-server and SFTP logs after a website defacement, pick the offending source IP and IoC, then choose containment actions. The page establishes 41.21.18.102 as the external actor, modified index.html as the evidence, and password reset plus external SFTP blocking as fixes.
Learners often chase the single failed login or the multiple TCP TIME_WAIT connections as the compromise signal, instead of tying the external successful login to the actual index.html write and then choosing containment that revokes the compromised account and exposure.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The incident statement says the website was maliciously altered, so the analyst must find the external session that actually wrote the web content. In the exhibits, 41.21.18.102 authenticates as sjames and then the session changes into /var/www and writes index.html; that direct write is the defacement, not mere login noise. The same account also appears with a private address, indicating credential misuse from an external source rather than a normal internal admin action. Therefore the source IP is 41.21.18.102, the IoC is the modified /var/www/index.html file, and the corrective actions must revoke the compromised sjames credential and close external SFTP exposure.Why Other Candidate Answers Are Wrong
32.111.16.37 is a distractor because it shows only one failed login after a prior successful login, which is more consistent with a typo or isolated failed attempt than a brute-force or defacement source. Choosing TCP TIME_WAIT entries as the IoC ignores the actual file write and mistakes normal connection teardown for malicious activity. A private/internal address is also a weaker source-IP choice when the evidence ties the unauthorized index.html modification to the external 41.21.18.102 session. Corrective-action distractors that only restore the web page, block a single IP, or leave sjames and external SFTP usable do not address the compromised credential and access path.Community Comment Notes
TommyZ focused on the wording "website was maliciously altered" and tied it to the 41.x login that modifies index.html, which matches the direct evidence. Popeyes_Chicken questioned 32.111.16.37 because there is only one failed attempt after a successful login and the TIME_WAIT connections may be legitimate, while noting the modification happened right after 41.21.18.102 authenticated. 7167087 and 7b52438 reached the same practical set: 41.21.18.102, modified index.html, change the sjames password, and block external SFTP access. taketaa added that sjames is logged in from both a private and a public address and that the 41 address remains logged in, reinforcing the need to evict the session.Exam Strategy
Read the incident statement first: 'website was maliciously altered' tells you to find the successful external login that wrote the web root, not every suspicious log line. For corrective actions, pick containment that removes the credential and access path used, not just cosmetic restoration.
Frequently Asked Questions
Why is 41.21.18.102 the source IP rather than 32.111.16.37 in this website defacement simulation?
The 41.21.18.102 login succeeds from an external address just before the /var/www/index.html write; 32.111.16.37 shows only one failed attempt after a valid login, which is weaker evidence.
Which corrective actions should be selected for the modified index.html incident?
Change the sjames account password to evict the compromised credential, and block external SFTP access so the same external path cannot be reused.