A penetration tester is evaluating a web application that returns the same HTTP response regardless of whether a SQL query returns rows or not. The tester has confirmed that the application is vulnerable to SQL injection but cannot distinguish true from false responses. Which technique should the tester use to extract data from the database?

Error-based SQL injection to trigger verbose database errors

Out-of-band SQL injection using DNS exfiltration

Union-based SQL injection to display data in the response

Time-based blind SQL injection using conditional delays

A web application firewall (WAF) blocks requests that contain the string 'UNION SELECT' in the query string. A penetration tester has identified a SQL injection point in a search parameter and needs to perform a UNION-based attack. Which approach is most likely to bypass the WAF rule?

Replace spaces with comments such as '/**/' between keywords

Encode the entire payload in hexadecimal

Use a boolean-based blind injection instead of UNION

A security analyst is testing a search form that returns product names. The analyst wants to determine whether the 'category' parameter is vulnerable to SQL injection. Which test would most reliably confirm the vulnerability without relying on visible output?

Submit a boolean condition that always evaluates to true and compare the number of results

Submit a time-based payload and measure the response delay

Submit a UNION SELECT with a different number of columns

Submit a single quote and observe if an error message appears

What is the primary purpose of using a UNION-based SQL injection?

To combine the results of the original query with results from other tables

To cause a time delay in the database response

To generate database errors that reveal information

To send data to an external server via DNS or HTTP

EC-CouncilWeb Application Hacking and Security

Domain 2Objective 1

Advanced SQL Injection (SQLi) WAHS Practice Questions (Page 6)

Part of the Injection Attacks domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

9concepts

Questions 26–30

26application · medium
A penetration tester is evaluating a web application that returns the same HTTP response regardless of whether a SQL query returns rows or not. The tester has confirmed that the application is vulnerable to SQL injection but cannot distinguish true from false responses. Which technique should the tester use to extract data from the database?
Select an answer first
27application · medium
A web application firewall (WAF) blocks requests that contain the string 'UNION SELECT' in the query string. A penetration tester has identified a SQL injection point in a search parameter and needs to perform a UNION-based attack. Which approach is most likely to bypass the WAF rule?
Select an answer first
28application · medium
A security analyst is testing a search form that returns product names. The analyst wants to determine whether the 'category' parameter is vulnerable to SQL injection. Which test would most reliably confirm the vulnerability without relying on visible output?
Select an answer first
29foundation · easy
Which of the following SQL functions is commonly used in error-based SQL injection to extract data via error messages?
Select an answer first
30foundation · easy
What is the primary purpose of using a UNION-based SQL injection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Advanced SQL Injection (SQLi) WAHS Practice Questions (Page 6)

Questions 26–30

A web application firewall (WAF) blocks requests that contain the string 'UNION SELECT' in the query string. A penetration tester has identified a SQL injection point in a search parameter and needs to perform a UNION-based attack. Which approach is most likely to bypass the WAF rule?

A security analyst is testing a search form that returns product names. The analyst wants to determine whether the 'category' parameter is vulnerable to SQL injection. Which test would most reliably confirm the vulnerability without relying on visible output?

Which of the following SQL functions is commonly used in error-based SQL injection to extract data via error messages?

What is the primary purpose of using a UNION-based SQL injection?

Keep studying — Injection Attacks