Before executing a UNION-based injection, what must an attacker first determine about the original query?

The IP address of the database server

The number of columns returned by the original query

The name of the table being queried

Which of the following is the most effective defense against SQL injection?

Using parameterized queries (prepared statements)

Escaping all user input with a generic escape function

Using a Web Application Firewall (WAF)

Validating input against a whitelist of allowed characters

A web application has a search feature that returns 'No results found' when a query returns no rows, and 'Results found' when rows exist. A tester wants to extract the first character of the admin password hash. Which payload is most appropriate?

' AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='a'--

' UNION SELECT password FROM users--

A tester is assessing a web application that filters out the words 'AND', 'OR', 'SELECT', and 'UNION'. The application returns different responses for true and false conditions. Which technique is most effective to extract data?

Use UNION-based injection with inline comments.

Use boolean-based blind injection with && and || operators.

Use error-based injection with extractvalue().

Use time-based blind injection with SLEEP(5).

EC-CouncilWeb Application Hacking and Security

Domain 2Objective 1

Advanced SQL Injection (SQLi) WAHS Practice Questions (Page 1)

Part of the Injection Attacks domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

9concepts

Questions 1–5

1foundation · easy
Which of the following is a common channel used for out-of-band SQL injection data exfiltration?
Select an answer first
2foundation · easy
Before executing a UNION-based injection, what must an attacker first determine about the original query?
Select an answer first
3foundation · easy
Which of the following is the most effective defense against SQL injection?
Select an answer first
4application · medium
A web application has a search feature that returns 'No results found' when a query returns no rows, and 'Results found' when rows exist. A tester wants to extract the first character of the admin password hash. Which payload is most appropriate?
Select an answer first
5expert · hard
A tester is assessing a web application that filters out the words 'AND', 'OR', 'SELECT', and 'UNION'. The application returns different responses for true and false conditions. Which technique is most effective to extract data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.