What is the role of a web application firewall (WAF) in mitigating SQL injection?

To filter and block malicious SQL injection payloads before they reach the application

To automatically fix SQL injection vulnerabilities in the application code

To encrypt the database at rest

To replace the need for secure coding practices

A security architect is designing a defense-in-depth strategy for a web application that handles sensitive customer data. The application uses a relational database and has been previously compromised via SQL injection. The architect must balance security with performance and operational overhead. Which combination of controls provides the most balanced and effective defense?

Stored procedures and encryption of data at rest

Input validation only, because it is the simplest and fastest

A WAF with a positive security model and no code changes

Parameterized queries, a WAF with a negative security model, and database activity monitoring

A development team is building a new web application that will handle sensitive customer data. The team wants to ensure that SQL injection is prevented from the start. Which coding practice should the team mandate for all database queries?

Sanitize all user input by removing SQL keywords like SELECT and UNION.

Use parameterized queries or prepared statements for all database interactions.

Store all database queries in stored procedures.

Use a web application firewall (WAF) as the primary defense.

How can SQL injection be used to bypass authentication?

By injecting a payload that alters the WHERE clause of a login query to always return true

By sending a specially crafted packet to the web server's firewall

By resetting the user's password through the forgot-password feature

By using a brute-force attack to guess the administrator's password

In a time-based blind SQL injection, what does the attacker typically use to infer information?

Database error messages that reveal table names

The HTTP status code returned by the web server

The response time of the database query

The number of rows returned in the application's response

EC-CouncilEthical Hacking Essentials

Domain 6Objective 3

SQL Injection Attacks and Countermeasures EHE Practice Questions (Page 8)

Part of the Web Application Attacks and Countermeasures domain, which makes up ~9% of our current practice bank.

43questions here

9free pages

7concepts

Questions 36–40

36foundation · easy
What is the role of a web application firewall (WAF) in mitigating SQL injection?
Select an answer first
37expert · hard
A security architect is designing a defense-in-depth strategy for a web application that handles sensitive customer data. The application uses a relational database and has been previously compromised via SQL injection. The architect must balance security with performance and operational overhead. Which combination of controls provides the most balanced and effective defense?
Select an answer first
38application · medium
A development team is building a new web application that will handle sensitive customer data. The team wants to ensure that SQL injection is prevented from the start. Which coding practice should the team mandate for all database queries?
Select an answer first
39foundation · easy
How can SQL injection be used to bypass authentication?
Select an answer first
40foundation · easy
In a time-based blind SQL injection, what does the attacker typically use to infer information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.