SQL Injection Attacks and Countermeasures EHE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A development team is fixing a login form that is vulnerable to SQL injection. The application must continue to support complex search filters on the same database. Which remediation provides the strongest protection against SQL injection while preserving the search functionality?

   • AUse parameterized queries for all database access
   • BRemove all special characters from user input
   • CUse a web application firewall to block malicious requests
   • DEscape all single quotes in user input before building the query
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A database administrator is hardening a database server that supports a web application. The application uses a single database account for all queries. To reduce the impact of a successful SQL injection attack, which action should the administrator take?

   • AChange the database port to a non-default value.
   • BCreate separate database accounts with the minimum privileges required for each application function.
   • CSet the database to read-only mode.
   • DEnable SSL/TLS for database connections.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A penetration tester is assessing a web application's search feature. The application does not display database error messages, and the tester cannot see the results of injected queries directly. However, when the tester submits a single quote, the page returns a generic error; when submitting a valid search term, the page displays results. The tester wants to determine whether the application is vulnerable to SQL injection without relying on visible output. Which technique should the tester use?

   • ATime-based blind SQL injection using a conditional delay (e.g., IF condition THEN WAITFOR DELAY).
   • BUNION-based SQL injection to extract data in the same response.
   • CError-based SQL injection to force the database to reveal information in error messages.
   • DOut-of-band SQL injection using DNS requests to exfiltrate data.
   Reveal Solution Discussion Select an answer first
5. 24application · hard

   A security team is reviewing web server logs and notices a series of requests to a search endpoint containing the pattern: 'search=test%27%20OR%20%271%27%3D%271'. The team suspects an automated SQL injection scan. Which type of SQL injection is the attacker likely testing for?

   • AThe payload is a generic SQL injection probe, and the type cannot be determined from the log alone.
   • BOut-of-band SQL injection, because the payload uses a comment to terminate the query.
   • CIn-band SQL injection, because the payload includes an OR condition that could be used to manipulate the query result.
   • DBlind SQL injection, because the payload is encoded and does not rely on visible output.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard · select all that apply

   A security team is assessing the potential impact of a SQL injection vulnerability in a customer-facing web application. The application connects to a database using an account with sysadmin privileges. Which of the following are realistic consequences of a successful SQL injection attack in this scenario? (Select all that apply.)

   • AThe attacker can potentially execute operating system commands through the database
   • BThe attacker can read all data in the database, including other customers' records
   • CThe attacker can modify or delete data, causing integrity loss
   • DThe attacker can bypass authentication and log in as any user
   • EThe attacker can only access data in the current table
   Check answers Discussion Select an answer first