SQL Injection Attacks and Countermeasures EHE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is migrating a legacy application to a new platform. The application has a SQL injection vulnerability in a search feature that is heavily used by customers. The team must remediate the vulnerability without changing the user interface or breaking search functionality. Which approach best meets these requirements?

   • AAdd a WAF rule that blocks all requests containing the word 'OR'
   • BRefactor the search query to use parameterized queries while preserving the same search logic
   • CDisable the search feature temporarily
   • DReplace the search feature with a simple dropdown menu
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is migrating a legacy application to a new platform. The legacy code has numerous SQL injection vulnerabilities, and the team is considering rewriting the data access layer. The project has a tight deadline and limited budget. Which approach balances security improvement with the constraints?

   • ARewrite the data access layer to use parameterized queries for all database interactions.
   • BUse input validation to block SQL keywords and special characters.
   • CDisable database error messages and restrict database permissions.
   • DDeploy a WAF and defer the rewrite to a later phase.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security consultant is reviewing a web application that uses an ORM (Object-Relational Mapping) framework. The developers claim the ORM automatically prevents SQL injection. During the review, the consultant finds a custom query built with string concatenation that includes user input. What is the most accurate assessment of the risk?

   • AThe ORM automatically sanitizes all queries, so there is no risk
   • BThe risk is limited to denial of service because the query is read-only
   • CThe risk is low because ORMs use parameterized queries by default
   • DThe custom query is vulnerable to SQL injection despite the ORM's protections
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a potential consequence of a successful SQL injection attack?

   • APermanent loss of the web server's public IP address
   • BPhysical damage to the server hardware
   • CAutomatic installation of a hypervisor on the server
   • DTheft of sensitive data from the database
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the purpose of applying the principle of least privilege to database accounts used by web applications?

   • ATo ensure the application can access all tables in the database
   • BTo simplify the database schema design
   • CTo limit the potential damage of a successful SQL injection attack
   • DTo increase the speed of database queries
   Reveal Solution Discussion Select an answer first