401 SEC+ Exam Guaranteed Pass: Expert Solutions
& Questions from World-Leading Universities for
Academic Success
Sara, a hacker, is completing a website form to request a free coupon. The site has a field
that limits the request to 3 or fewer coupons. While submitting the form, Sara runs an
application on her machine to intercept the HTTP POST command and change the field
from 3 coupons to 30.
Which of the following was used to perform this attack?
A. SQL injection
B. XML injection
C. Packet sniffer
D. Proxy - -correct ans- -Answer: B
Explanation:
When a web user takes advantage of a weakness with SQL by entering values that they
should not, it is known as a SQL injection attack. Similarly, when the user enters values
that query XML (known as XPath) with values that take advantage of exploits, it is known as
an XML injection attack. XPath works in a similar manner to SQL, except that it does not
have the same levels of access control, and taking advantage of weaknesses within can
return entire documents. The best way to prevent XML injection attacks is to filter the user's
input and sanitize it to make certain that it does not cause XPath to return more data than it
should.
A malicious individual is attempting to write too much data to an application's memory.
Which of the following describes this type of attack?
A. Zero-day
B. SQL injection
C. Buffer overflow
D. XSRF - -correct ans- -Answer: C
,Explanation:
A buffer overflow occurs when a program or process tries to store more data in a buffer
(temporary data storage area) than it was intended to hold. Since buffers are created to
contain a finite amount of data, the extra information - which has to go somewhere - can
overflow into adjacent buffers, corrupting or overwriting the valid data held in them.
Although it may occur accidentally through programming error, buffer overflow is an
increasingly common type of security attack on data integrity. In buffer overflow attacks,
the extra data may contain codes designed to trigger specific actions, in effect sending new
instructions to the attacked computer that could, for example, damage the user's files,
change data, or disclose confidential information. Buffer overflow attacks are said to have
arisen because the C programming language supplied the framework, and poor
programming practices supplied the vulnerability
Which of the following BEST describes a protective countermeasure for SQL injection?
A. Eliminating cross-site scripting vulnerabilities
B. Installing an IDS to monitor network traffic
C. Validating user input in web applications
D. Placing a firewall between the Internet and database servers - -correct ans- -Answer: C
Explanation:
By validating user input and preventing special characters, we can prevent the injection of
clientside scripting code.
SQL injection is a code injection technique, used to attack data-driven applications, in
which malicious SQL statements are inserted into an entry field for execution (e.g. to dump
the database contents to the attacker). SQL injection must exploit a security vulnerability in
an application's software, for example, when user input is either incorrectly filtered for
string literal escape characters embedded in SQL statements or user input is not strongly
typed and unexpectedly executed. SQL injection is mostly known as an attack vector for
websites but can be used to attack any type of SQL database.
A security administrator looking through IDS logs notices the following entry: (where
email= and passwd= 'or 1==1')
, Which of the following attacks had the administrator discovered?
A. SQL injection
B. XML injection
C. Cross-site script
D. Header manipulation - -correct ans- -Answer: A
Explanation:
The code in the question is an example of a SQL Injection attack. The code '1==1' will
always provide a value of true. This can be included in statement designed to return all
rows in a SQL table.
SQL injection is a code injection technique, used to attack data-driven applications, in
which malicious SQL statements are inserted into an entry field for execution (e.g. to dump
thedatabase contents to the attacker). SQL injection must exploit a security vulnerability in
an application's software, for example, when user input is either incorrectly filtered for
string literal escape characters embedded in SQL statements or user input is not strongly
typed and unexpectedly executed. SQL injection is mostly known as an attack vector for
websites but can be used to attack any type of SQL database.
Which of the following types of application attacks would be used to specifically gain
unauthorized information from databases that did not have any input validation
implemented?
A. SQL injection
B. Session hijacking and XML injection
C. Cookies and attachments
D. Buffer overflow and XSS - -correct ans- -Answer: A
Explanation:
To access information in databases, you use SQL. To gain unauthorized information from
databases, a SQL Injection attack is used.
& Questions from World-Leading Universities for
Academic Success
Sara, a hacker, is completing a website form to request a free coupon. The site has a field
that limits the request to 3 or fewer coupons. While submitting the form, Sara runs an
application on her machine to intercept the HTTP POST command and change the field
from 3 coupons to 30.
Which of the following was used to perform this attack?
A. SQL injection
B. XML injection
C. Packet sniffer
D. Proxy - -correct ans- -Answer: B
Explanation:
When a web user takes advantage of a weakness with SQL by entering values that they
should not, it is known as a SQL injection attack. Similarly, when the user enters values
that query XML (known as XPath) with values that take advantage of exploits, it is known as
an XML injection attack. XPath works in a similar manner to SQL, except that it does not
have the same levels of access control, and taking advantage of weaknesses within can
return entire documents. The best way to prevent XML injection attacks is to filter the user's
input and sanitize it to make certain that it does not cause XPath to return more data than it
should.
A malicious individual is attempting to write too much data to an application's memory.
Which of the following describes this type of attack?
A. Zero-day
B. SQL injection
C. Buffer overflow
D. XSRF - -correct ans- -Answer: C
,Explanation:
A buffer overflow occurs when a program or process tries to store more data in a buffer
(temporary data storage area) than it was intended to hold. Since buffers are created to
contain a finite amount of data, the extra information - which has to go somewhere - can
overflow into adjacent buffers, corrupting or overwriting the valid data held in them.
Although it may occur accidentally through programming error, buffer overflow is an
increasingly common type of security attack on data integrity. In buffer overflow attacks,
the extra data may contain codes designed to trigger specific actions, in effect sending new
instructions to the attacked computer that could, for example, damage the user's files,
change data, or disclose confidential information. Buffer overflow attacks are said to have
arisen because the C programming language supplied the framework, and poor
programming practices supplied the vulnerability
Which of the following BEST describes a protective countermeasure for SQL injection?
A. Eliminating cross-site scripting vulnerabilities
B. Installing an IDS to monitor network traffic
C. Validating user input in web applications
D. Placing a firewall between the Internet and database servers - -correct ans- -Answer: C
Explanation:
By validating user input and preventing special characters, we can prevent the injection of
clientside scripting code.
SQL injection is a code injection technique, used to attack data-driven applications, in
which malicious SQL statements are inserted into an entry field for execution (e.g. to dump
the database contents to the attacker). SQL injection must exploit a security vulnerability in
an application's software, for example, when user input is either incorrectly filtered for
string literal escape characters embedded in SQL statements or user input is not strongly
typed and unexpectedly executed. SQL injection is mostly known as an attack vector for
websites but can be used to attack any type of SQL database.
A security administrator looking through IDS logs notices the following entry: (where
email= and passwd= 'or 1==1')
, Which of the following attacks had the administrator discovered?
A. SQL injection
B. XML injection
C. Cross-site script
D. Header manipulation - -correct ans- -Answer: A
Explanation:
The code in the question is an example of a SQL Injection attack. The code '1==1' will
always provide a value of true. This can be included in statement designed to return all
rows in a SQL table.
SQL injection is a code injection technique, used to attack data-driven applications, in
which malicious SQL statements are inserted into an entry field for execution (e.g. to dump
thedatabase contents to the attacker). SQL injection must exploit a security vulnerability in
an application's software, for example, when user input is either incorrectly filtered for
string literal escape characters embedded in SQL statements or user input is not strongly
typed and unexpectedly executed. SQL injection is mostly known as an attack vector for
websites but can be used to attack any type of SQL database.
Which of the following types of application attacks would be used to specifically gain
unauthorized information from databases that did not have any input validation
implemented?
A. SQL injection
B. Session hijacking and XML injection
C. Cookies and attachments
D. Buffer overflow and XSS - -correct ans- -Answer: A
Explanation:
To access information in databases, you use SQL. To gain unauthorized information from
databases, a SQL Injection attack is used.
