CSA (312-39) SOC Simulation Lab

Welcome to this Tier 3 SOC simulation focused on web application reconnaissance. Analyze the SIEM telemetry to determine the attacker's intent and identify the primary security risk.

Scenario Context

You are a SOC analyst at MedCare Health. The organization operates a sensitive patient portal hosted on IIS behind an F5 Web Application Firewall (WAF). Alert fatigue is currently high due to an un-tuned internal vulnerability scanner. However, a Tier 1 analyst has escalated an alert titled Unusual HTTP Method Detected hitting the DMZ from an external IP.

The source IP is associated with known anonymizer exit nodes, and the traffic pattern does not match your authorized scanning schedules. The WAF is currently in transparent/logging mode for this specific vServer due to a recent migration.

Security Environment

Review the correlated logs pulled from the SIEM (Splunk) covering the timeframe of the alert:

index=web sourcetype=f5:waf src_ip=198.51.100.45 dest_port=443 | table _time, src_ip, http_method, uri_path, status, http_user_agent _time src_ip http_method uri_path status http_user_agent --------------------------------------------------------------------------------------------------- 2026-04-08 02:14:01 198.51.100.45 GET /login 200 Mozilla/5.0... 2026-04-08 02:14:05 198.51.100.45 OPTIONS /login 200 python-requests/2.28.1 2026-04-08 02:14:07 198.51.100.45 TRACE /login 200 python-requests/2.28.1 2026-04-08 02:15:12 198.51.100.45 GET /api/v1/health 401 python-requests/2.28.1 [RAW RESPONSE CAPTURE - EVENT ID: 021405] HTTP/1.1 200 OK Date: Wed, 08 Apr 2026 02:14:05 GMT Server: Microsoft-IIS/10.0 Allow: OPTIONS, TRACE, GET, HEAD, POST Public: OPTIONS, TRACE, GET, HEAD, POST [RAW RESPONSE CAPTURE - EVENT ID: 021407] HTTP/1.1 200 OK Date: Wed, 08 Apr 2026 02:14:07 GMT Content-Type: message/http TRACE /login HTTP/1.1 Host: portal.medcare.local User-Agent: python-requests/2.28.1 X-Forwarded-For: 198.51.100.45 Cookie: session_id=abc123xyz890...

Question

A healthcare organization's SIEM detects a series of unusual HTTP requests targeting its patient portal. The requests originate from a foreign IP address and occur during non-business hours. The methods used are primarily TRACE and OPTIONS, which are rarely seen in normal web traffic. The SIEM correlates these events with an increase in reconnaissance activity on other servers within the same subnet. What is the primary security concern with TRACE and OPTIONS requests?
A They expose information about server-supported methods and request headers
B They allow attackers to bypass authentication controls
C They can be used to upload malicious payloads directly to the server
D They make Distributed Denial of Service (DDoS) attack easier
SOC Hint: Look closely at the raw response captures in the SIEM logs. What exact data is the server handing back to the client when these specific methods are used? Does it let them log in, or does it give them a blueprint?

SOC Analyst Mini-Lesson: HTTP Method Profiling

In standard web traffic, over 99% of requests use GET, POST, or HEAD. Alerting on anomalous methods is a high-fidelity way to detect reconnaissance tools (like Nmap, Nikto, or Burp Suite) before exploitation begins.

Detection Logic Pattern:
event_type=HTTP AND http_method NOT IN ("GET", "POST", "HEAD") AND http_method IN ("OPTIONS", "TRACE", "TRACK", "PUT", "DELETE")

If you see a successful (Status 200) TRACE request in production, escalate it immediately. WAFs and reverse proxies should be configured to drop these methods by default unless a specific API endpoint explicitly requires them.

Ready for the next incident?

Explore more CSA simulations at ExamRange →