2.6 Describe Web Application Attacks, Such as SQL Injection, Command Injections, and Cross-Site Scripting 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following best describes how cross-site scripting (XSS) attacks work?

   • AThey inject malicious scripts into web pages that are executed in the browsers of other users.
   • BThey inject malicious shell commands into server-side scripts to execute OS commands.
   • CThey inject malicious SQL commands into database queries to manipulate data.
   • DThey inject malicious packets into the network to intercept user traffic.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing a web application that allows users to search for products by name. The application constructs a SQL query by concatenating the user input. An attacker submits `product' UNION SELECT username, password FROM users--` and receives a list of usernames and password hashes in the response. Which of the following best describes the attack and the most effective mitigation?

   • ACross-site scripting; encode the search results before displaying them.
   • BSQL injection; disable the database error messages to prevent information disclosure.
   • CCommand injection; use input validation to reject the word 'UNION'.
   • DSQL injection; use parameterized queries to prevent the input from being interpreted as SQL.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is examining web server logs and finds a request to a login page with the parameter `username=admin'--`. The application returned a successful login response without a valid password. Which attack is most likely being attempted?

   • AReflected XSS
   • BDOM-based XSS
   • CSQL injection
   • DCommand injection
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is investigating a phishing email that contains a link to a legitimate website. The link includes a parameter that reflects the user's input in the page without proper sanitization. When a victim clicks the link, a script executes in their browser and sends their session cookie to an attacker-controlled server. Which attack is this?

   • ACommand injection
   • BReflected cross-site scripting (XSS)
   • CStored cross-site scripting (XSS)
   • DSQL injection
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing a web application's login form. The application constructs a SQL query by concatenating the username and password directly into the query string. An attacker submits `' OR '1'='1` as the username and a random password. Which outcome is most likely?

   • AThe attacker receives an error message indicating a syntax error.
   • BThe attacker is logged in as the first user in the database.
   • CThe attacker's browser executes a script that steals the session cookie.
   • DThe attacker is blocked by the web application firewall.
   Reveal Solution Discussion Select an answer first