nerdexam
Cisco

200-201 · Question #95

Refer to the exhibit. This request was sent to a web application server driven by a database. Which type of web server attack is represented?

The correct answer is D. blind SQL injection. The request represents a blind SQL injection attack, where an attacker injects SQL queries and infers database information by observing the application's behavioral responses rather than direct data output.

Submitted by anna_se· Mar 6, 2026Network Intrusion Analysis

Question

Refer to the exhibit. This request was sent to a web application server driven by a database. Which type of web server attack is represented?

Options

  • Aparameter manipulation
  • Bheap memory corruption
  • Ccommand injection
  • Dblind SQL injection

How the community answered

(50 responses)
  • A
    6% (3)
  • B
    4% (2)
  • C
    14% (7)
  • D
    76% (38)

Why each option

The request represents a blind SQL injection attack, where an attacker injects SQL queries and infers database information by observing the application's behavioral responses rather than direct data output.

Aparameter manipulation

Parameter manipulation involves altering parameters in a URL or form field to bypass access controls or change application behavior, but not necessarily through SQL code injection for database interaction.

Bheap memory corruption

Heap memory corruption is a low-level exploit targeting memory vulnerabilities in the application's code, which is not typically represented by a string in a web request parameter.

Ccommand injection

Command injection typically involves injecting operating system commands (e.g., `& system_command`) into input fields to execute commands on the server, rather than SQL statements designed to interact with a database.

Dblind SQL injectionCorrect

Blind SQL injection attacks involve submitting SQL payloads where the application doesn't directly return database errors or query results to the user. Instead, the attacker deduces information by observing subtle changes in the application's behavior, such as time delays (time-based blind SQLi) or differences in page content (boolean-based blind SQLi), to determine if the injected condition was true or false.

Concept tested: Blind SQL Injection

Source: https://owasp.org/www-community/attacks/Blind_SQL_Injection

Topics

#SQL injection#web application attacks#database security

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice