Certified Ethical Hacker Ethical Hacker Security 4

Question 1

Which web vulnerability allows an attacker to inject malicious SQL into a query?

Accepted Answer

SQL injection

Answer

SQL injection inserts malicious SQL into input fields to manipulate the backend database.

Question 2

Stored cross-site scripting (XSS) is dangerous primarily because:

Accepted Answer

The payload persists and affects many users

Answer

Stored XSS saves the malicious script on the server, executing for every user who views the page.

Question 3

Which attack forces an authenticated user to execute unwanted actions on a web app?

Accepted Answer

CSRF

Answer

Cross-Site Request Forgery tricks a logged-in user's browser into sending forged requests.

Question 4

What is the best defense against SQL injection?

Accepted Answer

Parameterized queries

Answer

Parameterized (prepared) statements separate code from data, preventing injection.

Question 5

Which tool is a web server vulnerability scanner that checks for outdated software and misconfigurations?

Accepted Answer

Nikto

Answer

Nikto scans web servers for known vulnerabilities, dangerous files, and outdated versions.

Certified Ethical Hacker Practice Test