nerdexam
EC-Council

312-50V13 · Question #593

Consider a hypothetical situation where an attacker, known for his proficiency in SQL Injection attacks, is targeting your web server. This adversary meticulously crafts 'q' malicious SQL queries…

The correct answer is A. q=17, T=220: Even though the attacker increases 'q', the total delay ('q*d' = 221 seconds) just. The scenario where 'q=17' and 'd=13' results in a total delay of 221 seconds, which exceeds the threshold 'T=220', will most likely trigger an alert.

Submitted by yuriko_h· Mar 6, 2026SQL Injection

Question

Consider a hypothetical situation where an attacker, known for his proficiency in SQL Injection attacks, is targeting your web server. This adversary meticulously crafts 'q' malicious SQL queries, each inducing a delay of 'd' seconds in the server response. This delay in response is an indicator of a potential attack. If the total delay, represented by the product 'q*d', crosses a defined threshold 'T', an alert is activated in your security system. Furthermore, it is observed that the attacker prefers prime numbers for 'q', and 'd' follows a pattern in the Fibonacci sequence. Now, consider 'd=13' seconds (a Fibonacci number) and various values of 'q' (a prime number) and 'T'. Which among the following scenarios will most likely trigger an alert?

Options

  • Aq=17, T=220: Even though the attacker increases 'q', the total delay ('q*d' = 221 seconds) just
  • Bq=13, T=180: In this case, the total delay caused by the attacker ('q*d' = 169 seconds) breaches
  • Cq=11, T=150: Here, the total delay induced by the attacker ('q*d' = 143 seconds) does not
  • Dq=19, T=260: Despite the attacker's increased effort, the total delay ('q*d' = 247 seconds) does

How the community answered

(50 responses)
  • A
    70% (35)
  • B
    16% (8)
  • C
    4% (2)
  • D
    10% (5)

Why each option

The scenario where 'q=17' and 'd=13' results in a total delay of 221 seconds, which exceeds the threshold 'T=220', will most likely trigger an alert.

Aq=17, T=220: Even though the attacker increases 'q', the total delay ('q*d' = 221 seconds) justCorrect

In this scenario, the total delay is calculated as q * d = 17 * 13 = 221 seconds. Since this calculated total delay of 221 seconds is greater than the defined threshold T=220 seconds, an alert would be triggered. This directly matches the condition specified in the problem statement for an alert.

Bq=13, T=180: In this case, the total delay caused by the attacker ('q*d' = 169 seconds) breaches

For q=13, T=180, the total delay is 13 * 13 = 169 seconds. This delay (169) does not breach the threshold (180), so an alert would not be triggered.

Cq=11, T=150: Here, the total delay induced by the attacker ('q*d' = 143 seconds) does not

For q=11, T=150, the total delay is 11 * 13 = 143 seconds. This delay (143) does not breach the threshold (150), so an alert would not be triggered.

Dq=19, T=260: Despite the attacker's increased effort, the total delay ('q*d' = 247 seconds) does

For q=19, T=260, the total delay is 19 * 13 = 247 seconds. This delay (247) does not breach the threshold (260), so an alert would not be triggered.

Concept tested: SQL injection time-based detection logic

Topics

#SQL Injection#Time-based SQLi#Anomaly detection#Threshold alerting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V13 Practice