Web Application Injection Attacks GCIH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a buffer overflow?

   • AAn attack that injects malicious commands into the operating system.
   • BAn attack that injects malicious SQL into a database query.
   • CAn attack that exploits a misconfigured web server.
   • DA vulnerability where writing more data to a buffer than it can hold overwrites adjacent memory.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a secure way to construct an LDAP query with user input?

   • AConcatenating user input directly into the LDAP filter string.
   • BUsing a regex to remove all non-alphanumeric characters from input.
   • CBase64-encoding user input before inserting into the filter.
   • DUsing an LDAP library that provides parameterized search functions.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How can an attacker use LDAP injection to bypass authentication?

   • ABy exploiting a buffer overflow in the LDAP server.
   • BBy using a UNION query to combine LDAP results.
   • CBy injecting a filter like (&(uid=*)(userPassword=*)) to make the query always return a valid user.
   • DBy sending a large number of requests to overload the LDAP server.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A web application has a feature that allows users to ping an IP address. The application executes the command `ping -c 4 ` + userInput. An attacker submits `127.0.0.1; cat /etc/passwd`. The application returns the output of both commands. What is the most effective mitigation to prevent this attack?

   • AUse a WAF to block requests containing semicolons
   • BValidate that the input is a valid IP address using a library and reject any input that contains shell metacharacters
   • CUse a blacklist to block common commands like `cat`
   • DEscape all shell metacharacters in the input
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A development team is hardening an application that uses LDAP for user lookups. They want to prevent LDAP injection while maintaining functionality. Which practice is most effective?

   • AUse a WAF to block LDAP injection attempts
   • BUse a blacklist to block common LDAP injection payloads
   • CValidate input with a regex that only allows alphanumeric characters
   • DEscape all LDAP special characters in user input before constructing the query
   Reveal Solution Discussion Select an answer first