A security analyst is reviewing a web application that allows users to download files by passing a filename in a query parameter. The application constructs a command like `cat ` and returns the output. Which injection point is being exploited?

EC-CouncilWeb Application Hacking and Security

Domain 2Objective 2

Command Injection WAHS Practice Questions (Page 7)

Part of the Injection Attacks domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

5concepts

Questions 31–31

31application · easy
A security analyst is reviewing a web application that allows users to download files by passing a filename in a query parameter. The application constructs a command like `cat <filename>` and returns the output. Which injection point is being exploited?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Command Injection WAHS Practice Questions (Page 7)

Questions 31–31

A security analyst is reviewing a web application that allows users to download files by passing a filename in a query parameter. The application constructs a command like `cat <filename>` and returns the output. Which injection point is being exploited?

Keep studying — Injection Attacks