nerdexam
Cisco

350-201 · Question #129

Refer to the exhibit. Two types of clients are accessing the front ends and the core database that manages transactions, access control, and atomicity. What is the threat model for the SQL database?

The correct answer is A. An attacker can initiate a DoS attack. A SQL database handling transactions and atomicity for multiple client types is most threatened by denial-of-service attacks that exhaust connection or processing resources.

Techniques

Question

Refer to the exhibit. Two types of clients are accessing the front ends and the core database that manages transactions, access control, and atomicity. What is the threat model for the SQL database?

Exhibit

350-201 question #129 exhibit

Options

  • AAn attacker can initiate a DoS attack.
  • BAn attacker can read or change data.
  • CAn attacker can transfer data to an external server.
  • DAn attacker can modify the access logs.

How the community answered

(26 responses)
  • A
    65% (17)
  • B
    12% (3)
  • C
    19% (5)
  • D
    4% (1)

Why each option

A SQL database handling transactions and atomicity for multiple client types is most threatened by denial-of-service attacks that exhaust connection or processing resources.

AAn attacker can initiate a DoS attack.Correct

When two distinct client types simultaneously access a shared SQL database responsible for transactions, access control, and atomicity, an attacker can overwhelm the database with excessive requests or resource-intensive queries, causing a DoS condition that disrupts all transaction processing and access control enforcement. The database's role as a single centralized resource makes resource exhaustion the primary threat in this multi-client topology.

BAn attacker can read or change data.

Reading or changing data requires overcoming the access control layer enforced by the database, which is not the primary threat exposed by the described multi-client topology.

CAn attacker can transfer data to an external server.

Transferring data to an external server is an exfiltration threat that depends on compromise of client applications or network controls, not a direct SQL database threat model.

DAn attacker can modify the access logs.

Modifying access logs is a post-compromise action targeting audit integrity, not the primary threat model for a transactional SQL database serving multiple client types.

Concept tested: SQL database DoS threat modeling in multi-client architecture

Source: https://owasp.org/www-community/attacks/Denial_of_Service

Topics

#threat modeling#SQL database#DoS attack#access control

Community Discussion

No community discussion yet for this question.

Full 350-201 Practice