nerdexam
EC-Council

312-50V12 · Question #180

Consider a hypothetical situation where an attacker, known for his proficiency in SQL Injection attacks, is targeting your web server. This adversary meticulously crafts 'q' malicious SQL queries…

The correct answer is A. q=17, T=220: Even though the attacker increases 'q', the total delay ('q*d' = 221 seconds) just. This question requires calculating the total delay induced by an attacker's SQL injection attempts and determining which scenario results in this delay exceeding a defined security threshold, thereby triggering an alert.

Submitted by obi.ng· Mar 4, 2026Web Application Hacking

Question

Consider a hypothetical situation where an attacker, known for his proficiency in SQL Injection attacks, is targeting your web server. This adversary meticulously crafts 'q' malicious SQL queries, each inducing a delay of 'd' seconds in the server response. This delay in response is an indicator of a potential attack. If the total delay, represented by the product 'q*d', crosses a defined threshold 'T', an alert is activated in your security system. Furthermore, it is observed that the attacker prefers prime numbers for 'q', and 'd' follows a pattern in the Fibonacci sequence. Now, consider 'd=13' seconds (a Fibonacci number) and various values of 'q' (a prime number) and 'T'. Which among the following scenarios will most likely trigger an alert?

Options

  • Aq=17, T=220: Even though the attacker increases 'q', the total delay ('q*d' = 221 seconds) just
  • Bq=13, T=180: In this case, the total delay caused by the attacker ('q*d' = 169 seconds) breaches
  • Cq=11, T=150: Here, the total delay induced by the attacker ('q*d' = 143 seconds) does not
  • Dq=19, T=260: Despite the attacker's increased effort, the total delay ('q*d' = 247 seconds) does

How the community answered

(21 responses)
  • A
    57% (12)
  • B
    14% (3)
  • C
    5% (1)
  • D
    24% (5)

Why each option

This question requires calculating the total delay induced by an attacker's SQL injection attempts and determining which scenario results in this delay exceeding a defined security threshold, thereby triggering an alert.

Aq=17, T=220: Even though the attacker increases 'q', the total delay ('q*d' = 221 seconds) justCorrect

In this scenario, with q=17 and d=13, the total delay (q*d) is 17 * 13 = 221 seconds. Since this calculated total delay of 221 seconds is greater than the defined threshold (T) of 220 seconds, the condition (q*d > T) is met, and an alert is triggered.

Bq=13, T=180: In this case, the total delay caused by the attacker ('q*d' = 169 seconds) breaches

With q=13 and d=13, the total delay is 169 seconds, which is not greater than the threshold T=180 seconds, so no alert is triggered.

Cq=11, T=150: Here, the total delay induced by the attacker ('q*d' = 143 seconds) does not

Here, q=11 and d=13 result in a total delay of 143 seconds, which does not exceed the threshold T=150 seconds, preventing an alert.

Dq=19, T=260: Despite the attacker's increased effort, the total delay ('q*d' = 247 seconds) does

For q=19 and d=13, the total delay is 247 seconds, which is less than the threshold T=260 seconds, meaning no alert is activated.

Concept tested: Conditional alert trigger calculation based on thresholds

Topics

#SQL injection#time-based attack#attack detection#web vulnerability

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice