AP FRQ PrepChallenge 1/2

Log Analysis Challenge

Mirror of the AP Cybersecurity Free-Response "Device Security Analysis" question

Scenario: Web Server Under Attack

You are analyzing security logs for a company web server (192.168.1.50). The server hosts an internal HR portal accessible only to employees. Review the firewall rules and access logs, then answer the questions.

Device IP: 192.168.1.50

Source 1: Firewall Rules

Rule	Action	Source	Dest	Port	Dir
1	DENY	0.0.0.0/0	192.168.1.50	22 (SSH)	Inbound
2	ALLOW	192.168.10.0/24	192.168.1.50	443 (HTTPS)	Inbound
3	ALLOW	192.168.10.0/24	192.168.1.50	80 (HTTP)	Inbound
4	DENY	0.0.0.0/0	192.168.1.50	ANY	Inbound

Source 2: Server Access Log

Timestamp	Source IP	Action	Resource	Status
2026-06-18 08:14:22	192.168.10.15	GET	/hr/dashboard	200 OK
2026-06-18 08:15:03	45.33.32.156	GET	/hr/login	403 FORBIDDEN
2026-06-18 09:03:11	192.168.10.88	POST	/hr/login	401 UNAUTHORIZED
2026-06-18 09:03:14	192.168.10.88	POST	/hr/login	401 UNAUTHORIZED
2026-06-18 09:03:17	192.168.10.88	POST	/hr/login	401 UNAUTHORIZED
2026-06-18 09:03:20	192.168.10.88	POST	/hr/login	401 UNAUTHORIZED
2026-06-18 09:03:23	192.168.10.88	POST	/hr/login	200 OK
2026-06-18 09:03:25	192.168.10.88	GET	/hr/employees/export_all.csv	200 OK
2026-06-18 10:44:59	192.168.10.42	GET	/hr/dashboard	200 OK
2026-06-18 14:22:30	192.168.10.15	GET	/hr/payroll	200 OK