A company's web application has a legacy feature that executes a system command based on a filename selected from a dropdown list. The filenames are hardcoded on the server. Which of the following is the most secure way to refactor this feature?

Pass the filename to the shell with quotes

Sanitize the filename by removing special characters

Use an allowlist of filenames and map each to a predefined command

Use a blocklist of dangerous commands

A web application has a feature that allows users to download a file by passing a filename to a shell command. The developer used `os.system("cat " + filename)`. A security audit flags this as vulnerable. Which remediation is most effective?

Validate the filename against a whitelist of allowed characters.

Escape all shell metacharacters in the filename before concatenation.

Run the command with a low-privileged user account.

Use a file-reading API that does not invoke a shell.

Which of the following is the most effective mitigation against command injection?

Using parameterized queries or safe APIs that do not invoke a shell.

Encoding all user input with HTML entities.

Disabling JavaScript in the browser.

Blocking all user input with a Web Application Firewall (WAF).

A web application filters out `;`, `|`, `&`, and spaces from user input before passing it to a shell command. Which obfuscation technique could still allow command injection?

Using a newline character (`%0a`) as a separator

Using a semicolon with no spaces

Using a dollar sign to start a variable

A developer is fixing a command injection vulnerability in a tool that pings user-supplied IP addresses. The application must accept both IPv4 and IPv6 addresses. Which mitigation approach is most effective?

Use a blocklist of dangerous characters

Validate the input against a strict IP address pattern and use a parameterized API

Sanitize input by removing spaces and semicolons

Escape shell metacharacters in the input

EC-CouncilWeb Application Hacking and Security

Domain 2Objective 2

Command Injection WAHS Practice Questions (Page 1)

Part of the Injection Attacks domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

5concepts

Questions 1–5

1application · medium
A company's web application has a legacy feature that executes a system command based on a filename selected from a dropdown list. The filenames are hardcoded on the server. Which of the following is the most secure way to refactor this feature?
Select an answer first
2application · medium
A web application has a feature that allows users to download a file by passing a filename to a shell command. The developer used `os.system("cat " + filename)`. A security audit flags this as vulnerable. Which remediation is most effective?
Select an answer first
3foundation · easy
Which of the following is the most effective mitigation against command injection?
Select an answer first
4application · hard
A web application filters out `;`, `|`, `&`, and spaces from user input before passing it to a shell command. Which obfuscation technique could still allow command injection?
Select an answer first
5application · medium
A developer is fixing a command injection vulnerability in a tool that pings user-supplied IP addresses. The application must accept both IPv4 and IPv6 addresses. Which mitigation approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.