SQL Injection CEH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a potential impact of a successful SQL injection attack on a web application?

   • AThe web server's operating system becomes corrupted.
   • BThe application's SSL certificate is revoked.
   • CThe attacker can read, modify, or delete data stored in the database.
   • DThe application's source code is automatically rewritten to remove the vulnerability.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team is fixing a SQL injection vulnerability in a PHP application. The vulnerable code builds a query by concatenating user input directly into a SELECT statement. The team wants to implement a fix that is both effective and minimally invasive to the existing codebase. Which approach should they take?

   • AEscape all user input with a generic escape function before concatenation.
   • BRemove all user input from SQL queries by using stored procedures exclusively.
   • CAdd a Web Application Firewall (WAF) rule to block common SQL injection patterns.
   • DUse prepared statements with bound parameters for all database queries.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which automated tool is commonly used to detect SQL injection vulnerabilities by sending a series of payloads and analyzing the application's responses?

   • ANmap
   • BWireshark
   • CMetasploit
   • DBurp Suite
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An attacker uses a UNION-based SQL injection to extract data from a database. What must the attacker ensure about the UNION query?

   • AThe UNION keyword must be placed at the beginning of the query.
   • BThe attacker must have administrative privileges on the database.
   • CThe number of columns in the first SELECT statement must match the number of columns in the second SELECT statement.
   • DThe second SELECT statement must use the same table name as the first.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A development team is fixing a SQL injection vulnerability in a login form. The application is built on ASP.NET Core with Entity Framework Core. The team wants to prevent SQL injection while maintaining the ability to use dynamic filtering in a search endpoint. Which approach should they implement?

   • AUse stored procedures with dynamic SQL built from user input.
   • BEscape all user input by doubling single quotes before sending it to the database.
   • CUse parameterized LINQ queries or raw SQL with parameters for all database operations.
   • DImplement a global input validation filter that rejects any request containing single quotes or SQL keywords.
   Reveal Solution Discussion Select an answer first