SQL Injection Attacks and Countermeasures EHE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is the most effective defense against SQL injection?

   • AUsing parameterized queries (prepared statements)
   • BUsing a web application firewall (WAF) as the only defense
   • CBlocking all user input containing the word 'SELECT'
   • DDisabling the database error messages
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is using an automated scanner to identify SQL injection vulnerabilities in a web application. The scanner reports a potential blind SQL injection in a feedback form, but a manual review of the form shows that the input is sanitized. What should the team do next?

   • AImmediately patch the application without further testing
   • BDisable the scanner because it is producing false positives
   • CManually verify the finding by sending crafted payloads and observing response behavior
   • DIgnore the scanner result because the input is sanitized
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A database administrator is hardening a database server that supports a public-facing web application. The application only needs to perform SELECT, INSERT, and UPDATE operations on a single schema. Which database hardening measure provides the most direct reduction of SQL injection impact?

   • ACreate a database account with only the required permissions and no DDL or administrative rights
   • BMove the database to a different server on the same network
   • CDisable all database logging to reduce overhead
   • DEncrypt all data at rest in the database
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A development team is rewriting a legacy PHP application that has suffered multiple SQL injection attacks. The team wants to implement a defense that will prevent SQL injection for all database queries in the new code. Which approach should the team adopt?

   • ADisable error messages on the production server to hide database errors.
   • BRely on a web application firewall (WAF) to block malicious requests.
   • CUse prepared statements with parameterized queries for every database interaction.
   • DEscape all user input with a custom function before including it in queries.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which type of tool is commonly used to automate the detection of SQL injection vulnerabilities?

   • APort scanner
   • BWeb application vulnerability scanner
   • CDisk encryption tool
   • DNetwork packet sniffer
   Reveal Solution Discussion Select an answer first