2.6 Describe Web Application Attacks, Such as SQL Injection, Command Injections, and Cross-Site Scripting 200-201 Practice Questions (Page 6)

Questions 26–29

1. 26expert · hard

   A security analyst is reviewing a web application that has multiple vulnerabilities. The application has a file upload feature that passes the filename to a shell command, a search feature that is vulnerable to SQL injection, and a comment feature that is vulnerable to stored XSS. The analyst has limited time and resources. The application is used by a small team of internal users, not the public. Which vulnerability should be fixed first?

   • AAll vulnerabilities should be fixed simultaneously
   • BStored XSS in the comment feature
   • CCommand injection in the file upload feature
   • DSQL injection in the search feature
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A web application has a file upload feature that accepts a filename and passes it to a shell command to move the file. A security analyst discovers that uploading a file named `file.txt; rm -rf /` could delete files on the server. Which control is most effective to prevent this attack?

   • AValidate the filename against a whitelist of allowed characters and reject any that contain shell metacharacters.
   • BUse a parameterized query to insert the filename into the database.
   • CEncode the filename as HTML entities before displaying it in the browser.
   • DRun the web server as an unprivileged user.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A web developer at a retail company is reviewing a security report for the company's product search page. The report shows that a user submitted the following input in the search box: `' OR '1'='1`. The application returned all products in the database instead of only matching items. The developer wants to prevent this class of attack while still allowing legitimate search queries. Which remediation should the developer implement?

   • ADisable client-side JavaScript on the search page.
   • BAdd a Web Application Firewall rule to block requests containing single quotes.
   • CUse parameterized queries for all database access.
   • DEncode all output before displaying it in the browser.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is reviewing a web application that allows users to look up account balances by entering an account number. The application constructs a SQL query by concatenating the user input. An attacker submits `1234 OR 1=1` and receives the balances of all accounts. Which of the following is the most effective mitigation to prevent this type of attack?

   • AUse output encoding to prevent the response from being interpreted as HTML.
   • BUse a web application firewall to block all requests with 'OR 1=1'.
   • CUse parameterized queries or prepared statements for all database access.
   • DUse input validation to reject any input containing the word 'OR'.
   Reveal Solution Discussion Select an answer first