350-201 · Question #129
Refer to the exhibit. Two types of clients are accessing the front ends and the core database that manages transactions, access control, and atomicity. What is the threat model for the SQL database?
The correct answer is A. An attacker can initiate a DoS attack. A SQL database handling transactions and atomicity for multiple client types is most threatened by denial-of-service attacks that exhaust connection or processing resources.
Question
Refer to the exhibit. Two types of clients are accessing the front ends and the core database that manages transactions, access control, and atomicity. What is the threat model for the SQL database?
Exhibit
Options
- AAn attacker can initiate a DoS attack.
- BAn attacker can read or change data.
- CAn attacker can transfer data to an external server.
- DAn attacker can modify the access logs.
How the community answered
(26 responses)- A65% (17)
- B12% (3)
- C19% (5)
- D4% (1)
Why each option
A SQL database handling transactions and atomicity for multiple client types is most threatened by denial-of-service attacks that exhaust connection or processing resources.
When two distinct client types simultaneously access a shared SQL database responsible for transactions, access control, and atomicity, an attacker can overwhelm the database with excessive requests or resource-intensive queries, causing a DoS condition that disrupts all transaction processing and access control enforcement. The database's role as a single centralized resource makes resource exhaustion the primary threat in this multi-client topology.
Reading or changing data requires overcoming the access control layer enforced by the database, which is not the primary threat exposed by the described multi-client topology.
Transferring data to an external server is an exfiltration threat that depends on compromise of client applications or network controls, not a direct SQL database threat model.
Modifying access logs is a post-compromise action targeting audit integrity, not the primary threat model for a transactional SQL database serving multiple client types.
Concept tested: SQL database DoS threat modeling in multi-client architecture
Source: https://owasp.org/www-community/attacks/Denial_of_Service
Topics
Community Discussion
No community discussion yet for this question.
