Web Application Attacks and SQL Injection ECSS Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A web application has a search feature that takes a user-supplied keyword and uses it in a SQL query. The application filters out the word 'SELECT' and 'UNION' from the input. A tester submits the following payload: ' UNION SELECT username, password FROM users -- . The attack fails. Which of the following is the most likely reason?

   • AThe database does not support UNION queries.
   • BThe application filters out the keywords 'SELECT' and 'UNION' from the input, breaking the payload.
   • CThe application uses parameterized queries, so the input is treated as data.
   • DThe application uses a WAF that blocks the payload based on signature.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How does the principle of least privilege help mitigate SQL injection?

   • AIt limits the database account's permissions, reducing the impact of a successful injection.
   • BIt encrypts all data in the database.
   • CIt prevents the use of SQL queries altogether.
   • DIt requires all users to use strong passwords.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In a structured web application penetration test, which phase involves gathering information about the target application and its technologies?

   • AReporting
   • BScanning
   • CExploitation
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A developer is writing a search feature for a website. The developer wants to prevent SQL injection. Which coding practice is the most secure for handling user input in a SQL query?

   • AUse a blacklist to remove SQL keywords like SELECT, UNION, and OR from the input.
   • BUse a whitelist of allowed characters for the search term.
   • CUse a stored procedure that concatenates the input into a dynamic SQL string.
   • DUse a parameterized query with a prepared statement.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of the reporting phase in a web application penetration test?

   • ATo exploit all discovered vulnerabilities
   • BTo gather information about the target
   • CTo scan the application for open ports
   • DTo document vulnerabilities, risks, and remediation recommendations
   Reveal Solution Discussion Select an answer first