Which of the following techniques can be bypass a user or computer's web browser privacy settings? (Select Two)

SQL injection targets back-end database servers by manipulating SQL queries and does not interact with or bypass the web browser's privacy settings.

Session hijacking involves stealing or forging a valid session token, allowing an attacker to impersonate an authenticated user and bypass privacy controls such as cookie restrictions or access controls enforced by the browser, since the attacker's requests appear to originate from a legitimate, trusted session. This technique directly undermines privacy settings because it exploits the trust relationship between the browser and web server.

Cross-site scripting (XSS) injects malicious scripts into trusted web pages that execute within the victim's browser in the context of the vulnerable site, allowing the attacker to read cookies, session tokens, and other data that the browser's privacy settings would otherwise protect. Because the script runs as if it were legitimate site content, same-origin and privacy policies do not block it.

Locally Shared Objects (Flash cookies) are a privacy concern in their own right but are a storage mechanism, not an active attack technique used to bypass browser privacy settings in the context of this question.

LDAP injection manipulates LDAP directory service queries on the server side and has no direct interaction with a user's web browser privacy settings.