Certified Incident Handler (CIH) Practice Ecam

Which practice will not help incident responders in managing server-side request forgery attacks?

1. Allow raw response bodies from the internal server to clients

2. Utilize strict verification for incoming requests

3. Implement input validation on redirect URLs

4. Monitor request and response logs

The correct answer is: Allow raw response bodies from the internal server to clients

The practice of allowing raw response bodies from the internal server to clients does not help incident responders in managing server-side request forgery (SSRF) attacks because it increases the risk of sensitive internal data being exposed. SSRF attacks occur when an attacker sends a crafted request that the server processes, potentially accessing internal resources that are otherwise not exposed to the external network. Allowing raw response bodies can lead to situations where an attacker can read the details of the server’s internal responses, potentially gaining access to sensitive information or system details. In contrast, the other practices mentioned are effective at mitigating SSRF risks. Utilizing strict verification for incoming requests helps to ensure that only legitimate requests are processed, reducing the ability of an attacker to exploit the server. Implementing input validation on redirect URLs ensures that the URLs users are allowed to access are safe and do not point to internal resources. Monitoring request and response logs can provide valuable insights into suspicious activities and help incident responders detect potential SSRF exploits by analyzing the patterns and behaviors of incoming requests.