SQL Injection Attacks and Countermeasures EHE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which database hardening practice helps reduce the impact of SQL injection?

   • ADisabling unnecessary database features and services
   • BIncreasing the database connection timeout
   • CUsing a longer database name
   • DStoring all data in a single table
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A development team is migrating a monolithic application to microservices. The new services will use a shared database. The team wants to minimize the impact of a SQL injection in any single service. Which database architecture decision best supports this goal?

   • AUse a single database user with broad permissions to simplify administration
   • BUse a separate database schema per service and grant each service only the permissions it needs
   • CUse a shared database but encrypt all data at rest
   • DUse a single shared schema with a common database user for all services
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A penetration tester is evaluating a web application that returns different HTTP status codes (200 vs 500) based on whether a SQL condition is true or false. The application does not display query results or error messages. The tester wants to extract data from the database. Which technique is most appropriate?

   • ABoolean-based blind SQL injection, using the HTTP status code as the boolean indicator.
   • BUNION-based SQL injection, to retrieve data in the response body.
   • COut-of-band SQL injection, using DNS requests to exfiltrate data.
   • DTime-based blind SQL injection, using delays to infer conditions.
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   A web developer suspects that a search form on their company's website is vulnerable to SQL injection. The developer wants to perform a manual test that is likely to reveal the vulnerability without causing data loss. Which input should the developer submit to the search field to test for SQL injection?

   • AA single quote (') to see if it triggers a database error or unexpected behavior.
   • BA long string of 'A' characters to test input length limits.
   • CA JavaScript alert script (e.g., <script>alert(1)</script>) to test for XSS.
   • DA valid search term with special characters like '&' to test URL encoding.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which SQL injection technique uses the UNION keyword to combine the results of two or more SELECT statements?

   • ATime-based blind SQL injection
   • BBoolean-based blind SQL injection
   • CUNION-based SQL injection
   • DError-based SQL injection
   Reveal Solution Discussion Select an answer first