200-201 · Question #176
Refer to the exhibit. Which type of attack is being executed?
The correct answer is A. SQL injection. The exhibit displays an HTTP request where malicious SQL syntax has been inserted into a user input field, characteristic of a SQL injection attack.
Question
Refer to the exhibit. Which type of attack is being executed?
Options
- ASQL injection
- Bcross-site scripting
- Ccross-site request forgery
- Dcommand injection
How the community answered
(54 responses)- A76% (41)
- B13% (7)
- C4% (2)
- D7% (4)
Why each option
The exhibit displays an HTTP request where malicious SQL syntax has been inserted into a user input field, characteristic of a SQL injection attack.
A SQL injection attack occurs when an attacker inserts or "injects" malicious SQL queries into input fields to manipulate database queries or extract information, which would be visible as SQL syntax within user-provided data in the exhibit.
Cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into web pages viewed by other users, which would typically appear as <script> tags or similar HTML/JS in user input, not SQL syntax.
Cross-site request forgery (CSRF) tricks a victim into submitting an unwitting request to a legitimate web application, which would involve a forged request but not necessarily malicious input syntax within the request itself.
Command injection involves executing arbitrary commands on the host operating system, which would appear as shell commands (e.g., `cmd.exe`, `ls -la`, `cat /etc/passwd`) within user input fields, not SQL database commands.
Concept tested: Web application attack identification (SQL injection)
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/sql-injection
Topics
Community Discussion
No community discussion yet for this question.