Web Application Injection Attacks GCIH Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of applying the principle of least privilege to a database account used by a web application?

   • ATo simplify the database schema design.
   • BTo improve the performance of database queries.
   • CTo ensure that all users have access to the same data.
   • DTo reduce the potential impact of a successful SQL injection attack.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In a blind SQL injection attack, how does an attacker typically extract information from the database?

   • ABy exploiting a buffer overflow in the database server to execute commands.
   • BBy observing differences in application responses (true/false) to crafted queries.
   • CBy directly reading the database error messages that reveal query results.
   • DBy using UNION queries to combine results into the normal application output.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is LDAP injection?

   • AAn attack that injects malicious SQL into a database query.
   • BAn attack that injects malicious commands into the operating system.
   • CAn attack that manipulates LDAP queries by injecting malicious input to bypass access controls or extract data.
   • DAn attack that injects malicious XML into a parser.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which SQL injection technique is used to bypass authentication by making a WHERE clause always true?

   • AInjecting ' OR '1'='1' into the password field.
   • BSubmitting a malformed JSON payload to the login endpoint.
   • CUsing a time-based payload like WAITFOR DELAY '0:0:5'.
   • DUsing a UNION SELECT to combine results from another table.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A development team is fixing a buffer overflow vulnerability in a legacy C application. They want to implement a mitigation that is most effective and has the least impact on performance. Which approach should they choose?

   • AUse a WAF to block requests with long input
   • BEnable ASLR and DEP in the compiler
   • CAdd a canary value to the stack
   • DReplace unsafe functions like `strcpy` with safe alternatives like `strncpy` and perform bounds checking
   Reveal Solution Discussion Select an answer first