A development team is building a new feature that allows users to convert video files. The team wants to avoid command injection. Which design choice is most effective?

Run the conversion in a container with a read-only filesystem.

Use a video-processing library that accepts file paths and does not invoke a shell.

Use a WAF to block requests containing shell metacharacters.

Allow users to specify any command-line options for the video converter.

A web application allows users to enter a hostname to ping. The developer built the feature by concatenating the user input directly into a shell command: `ping -c 3 ` + userInput. A security review flags this as vulnerable. Which remediation would most effectively prevent command injection while preserving the intended functionality?

Escape all shell metacharacters in the user input before concatenating it into the command.

Wrap the command in double quotes so the shell treats the input as a single argument.

Use a server-side library that performs ICMP echo requests without invoking a shell.

Add client-side JavaScript validation to reject any input containing spaces or semicolons.

A penetration tester is testing a web application that accepts a 'domain' parameter and uses it in a `dig` command. The application does not return the output. The tester wants to confirm blind command injection and then exfiltrate data. Which technique is most effective?

Use a payload that triggers an error message containing the output.

Use a time-delay payload to confirm, then use a payload that sends data to an external server via HTTP.

Use a payload that changes the HTTP response code to indicate success or failure.

Use a payload that writes the output to a file in the web root.

A security auditor is testing a web application that passes user input to a command. The application filters out `;`, `|`, `&`, and spaces. The auditor wants to execute a command that requires spaces, such as `cat /etc/passwd`. Which technique would allow this?

Use a tab character instead of a space

Use `${IFS}` to represent spaces

Use a newline character to separate commands

A penetration tester discovers a blind command injection in a web application. The application runs as a low-privileged user, and the tester needs to confirm the vulnerability and determine the operating system. The tester can only send HTTP requests and cannot rely on outbound network connections. Which approach is most effective?

Use time-based delays with different commands (e.g., `sleep` vs `ping -n`) to infer the OS

Use a reverse shell to get interactive access

Use DNS exfiltration to send data to a controlled domain

Use a webhook to send data to an external server

EC-CouncilWeb Application Hacking and Security

Domain 2Objective 2

Command Injection WAHS Practice Questions (Page 6)

Part of the Injection Attacks domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

5concepts

Questions 26–30

26application · medium
A development team is building a new feature that allows users to convert video files. The team wants to avoid command injection. Which design choice is most effective?
Select an answer first
27application · medium
A web application allows users to enter a hostname to ping. The developer built the feature by concatenating the user input directly into a shell command: `ping -c 3 ` + userInput. A security review flags this as vulnerable. Which remediation would most effectively prevent command injection while preserving the intended functionality?
Select an answer first
28application · medium
A penetration tester is testing a web application that accepts a 'domain' parameter and uses it in a `dig` command. The application does not return the output. The tester wants to confirm blind command injection and then exfiltrate data. Which technique is most effective?
Select an answer first
29expert · hard
A security auditor is testing a web application that passes user input to a command. The application filters out `;`, `|`, `&`, and spaces. The auditor wants to execute a command that requires spaces, such as `cat /etc/passwd`. Which technique would allow this?
Select an answer first
30expert · hard
A penetration tester discovers a blind command injection in a web application. The application runs as a low-privileged user, and the tester needs to confirm the vulnerability and determine the operating system. The tester can only send HTTP requests and cannot rely on outbound network connections. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Command Injection WAHS Practice Questions (Page 6)

Questions 26–30

A development team is building a new feature that allows users to convert video files. The team wants to avoid command injection. Which design choice is most effective?

A penetration tester is testing a web application that accepts a 'domain' parameter and uses it in a `dig` command. The application does not return the output. The tester wants to confirm blind command injection and then exfiltrate data. Which technique is most effective?

A security auditor is testing a web application that passes user input to a command. The application filters out `;`, `|`, `&`, and spaces. The auditor wants to execute a command that requires spaces, such as `cat /etc/passwd`. Which technique would allow this?

Keep studying — Injection Attacks