nerdexam
CompTIA

SY0-301 · Question #617

Highly sensitive data is stored in a database and is accessed by an application on a DMZ server. The disk drives on all servers are fully encrypted. Communication between the application server and…

The correct answer is A. SQL Injection. SQL injection attacks the application layer by injecting malicious SQL code into input fields, bypassing disk encryption and network-level controls to directly manipulate or exfiltrate database contents.

Threats, vulnerabilities, and mitigations

Question

Highly sensitive data is stored in a database and is accessed by an application on a DMZ server. The disk drives on all servers are fully encrypted. Communication between the application server and end-users is also encrypted. Network ACLs prevent any connections to the database server except from the application server. Which of the following can still result in exposure of the sensitive data in the database server?

Options

  • ASQL Injection
  • BTheft of the physical database server
  • CCookies
  • DCross-site scripting

How the community answered

(36 responses)
  • A
    83% (30)
  • B
    3% (1)
  • C
    11% (4)
  • D
    3% (1)

Why each option

SQL injection attacks the application layer by injecting malicious SQL code into input fields, bypassing disk encryption and network-level controls to directly manipulate or exfiltrate database contents.

ASQL InjectionCorrect

SQL injection inserts malicious SQL statements through the application's input vectors, causing the database engine to execute unintended queries. Because the attack is processed by the running application and database engine - not stored data at rest - full disk encryption provides no protection against it. Network ACLs only restrict which servers can connect to the database, not what queries an authorized application server can run, so a compromised application can still be used to exfiltrate data.

BTheft of the physical database server

Full disk encryption on the database server directly mitigates physical theft by rendering the data unreadable without the decryption key.

CCookies

Cookies store client-side session or preference data in the browser and do not provide a vector to access a back-end database server.

DCross-site scripting

Cross-site scripting injects malicious scripts into web pages viewed by other users and targets client-side browsers, not server-side databases.

Concept tested: SQL injection bypassing encryption and network controls

Source: https://owasp.org/www-community/attacks/SQL_Injection

Topics

#SQL injection#application security#DMZ#defense in depth

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-301 Practice