A development team is fixing a SQL injection vulnerability in a Java application that builds SQL queries by string concatenation. The application must continue to support dynamic sorting by column name. Which mitigation is most appropriate?

Use stored procedures with dynamic SQL inside.

Use a WAF to block malicious payloads in the ORDER BY clause.

Use a whitelist of allowed column names and map user input to the actual column name.

Use parameterized queries for all user input, including the column name in ORDER BY.

A security analyst is testing a login form that returns a generic 'Invalid credentials' message for both incorrect usernames and incorrect passwords. The analyst suspects SQL injection but cannot see any database errors or data output. Which technique should the analyst use to confirm the vulnerability and extract the first character of the admin password?

UNION-based payloads to display the password in the login response

Out-of-band DNS requests to exfiltrate the password

Time-based payloads such as ' OR IF(1=1, SLEEP(5), 0) --

Boolean-based payloads that cause the login to succeed or fail based on a condition

What is the primary goal of an attacker exploiting a SQL injection vulnerability?

To execute arbitrary operating system commands on the web server

To cause a denial of service by crashing the database server

To bypass the web application firewall by encoding payloads

To manipulate SQL queries to access or modify data without proper authorization

A security tester is assessing a web application that displays a 'User found' or 'User not found' message based on a username parameter. The tester suspects SQL injection and wants to extract the database version. Which technique should the tester use?

Boolean-based blind injection with conditions like ' AND SUBSTRING(version(),1,1)='5' --

Error-based injection to trigger a database error containing the version

Out-of-band injection to send the version via DNS

Union-based injection to display the version in the response

EC-CouncilWeb Application Hacking and Security

Domain 2Objective 1

Advanced SQL Injection (SQLi) WAHS Practice Questions (Page 8)

Part of the Injection Attacks domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

9concepts

Questions 36–40

36application · medium
A development team is fixing a SQL injection vulnerability in a Java application that builds SQL queries by string concatenation. The application must continue to support dynamic sorting by column name. Which mitigation is most appropriate?
Select an answer first
37application · medium
A security analyst is testing a login form that returns a generic 'Invalid credentials' message for both incorrect usernames and incorrect passwords. The analyst suspects SQL injection but cannot see any database errors or data output. Which technique should the analyst use to confirm the vulnerability and extract the first character of the admin password?
Select an answer first
38foundation · easy
Which of the following payloads is used in boolean-based blind SQLi to test a true condition?
Select an answer first
39foundation · easy
What is the primary goal of an attacker exploiting a SQL injection vulnerability?
Select an answer first
40application · medium
A security tester is assessing a web application that displays a 'User found' or 'User not found' message based on a username parameter. The tester suspects SQL injection and wants to extract the database version. Which technique should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Advanced SQL Injection (SQLi) WAHS Practice Questions (Page 8)

Questions 36–40

A development team is fixing a SQL injection vulnerability in a Java application that builds SQL queries by string concatenation. The application must continue to support dynamic sorting by column name. Which mitigation is most appropriate?

Which of the following payloads is used in boolean-based blind SQLi to test a true condition?

What is the primary goal of an attacker exploiting a SQL injection vulnerability?

A security tester is assessing a web application that displays a 'User found' or 'User not found' message based on a username parameter. The tester suspects SQL injection and wants to extract the database version. Which technique should the tester use?

Keep studying — Injection Attacks