Web Application Attacks PT0-003 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which SQL injection technique is used to retrieve data from a database without directly seeing the results in the application's response?

   • ABlind SQL injection
   • BError-based SQL injection
   • CStacked queries injection
   • DUnion-based SQL injection
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of using a UNION-based SQL injection attack?

   • ATo force the database to return an error message that reveals table names.
   • BTo combine the results of two or more SELECT queries into a single result set.
   • CTo cause the database to execute multiple SQL statements in a single request.
   • DTo trigger a time delay in the database response to infer information.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is the most effective way to identify SQL injection vulnerabilities during a penetration test?

   • AChecking the web server's SSL certificate for validity.
   • BIntercepting and modifying HTTP requests to inject SQL payloads and observing the application's responses.
   • CReviewing the server's firewall rules to see if database traffic is allowed.
   • DRunning a port scan to identify open database ports on the target server.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is the most effective way to identify a directory traversal vulnerability during a penetration test?

   • AIntercepting and analyzing network traffic to look for unencrypted credentials.
   • BModifying file-related parameters to include path traversal sequences and observing the response.
   • CReviewing the server's firewall rules to see if outbound traffic is restricted.
   • DRunning a vulnerability scanner that only checks for missing security headers.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is the most reliable way to detect a reflected XSS vulnerability in a web application?

   • AReviewing the web server's access logs for suspicious IP addresses.
   • BChecking the HTTP response headers for the presence of Content-Security-Policy.
   • CSubmitting a unique string in a parameter and checking if it appears unencoded in the response.
   • DScanning the web server for open ports and services.
   Reveal Solution Discussion Select an answer first