1Z0-146 · Question #100
View the Exhibit and examine the procedure to create a trigger name based on the table name supplied to the procedure. Which three statements are appropriate for protecting the code in the procedure…
The correct answer is A. Explicitly validate the identifier length limit. D. Filter out control characters in user-supplied identifier names. E. Use the object ID of the table from the data dictionary to build the trigger name. B is wrong answer because an intruder would get privileges that they would not get if they used authid current_user. https://docs.oracle.com/cd/A97630_01/appdev.920/a96624/11_dynam.htm Look for Using Pragma RESTRICT_REFERENCES. In this particular case using RESTRICT_REFENCES…
Question
View the Exhibit and examine the procedure to create a trigger name based on the table name supplied to the procedure. Which three statements are appropriate for protecting the code in the procedure from SQL injection? (Choose three.)
Exhibit
Options
- AExplicitly validate the identifier length limit.
- BAdd AUTHID DEFINER to the definition of the procedure.
- CUse PRAGMA RESTRICT_REFERENCES in the procedure.
- DFilter out control characters in user-supplied identifier names.
- EUse the object ID of the table from the data dictionary to build the trigger name.
How the community answered
(37 responses)- A78% (29)
- B16% (6)
- C5% (2)
Explanation
B is wrong answer because an intruder would get privileges that they would not get if they used authid current_user. https://docs.oracle.com/cd/A97630_01/appdev.920/a96624/11_dynam.htm Look for Using Pragma RESTRICT_REFERENCES. In this particular case using RESTRICT_REFENCES will not protect us from injecting sql command into trigger's body.
Topics
Community Discussion
No community discussion yet for this question.