Courseiva
Web Application and Injection AttackshardMultiple SelectObjective-mapped

CEH Web Application and Injection Attacks Practice Question

Which THREE of the following are common indicators of an SQL injection attack? (Choose 3.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Unexpected rows or columns in query results

SQL injection attacks commonly cause unexpected rows or columns in query results due to manipulated queries, unusually slow database responses from resource-intensive operations like UNION or subqueries, and database error messages that reveal syntax or structure to the attacker. Frequent 302 redirects and many failed connection attempts are not typical or specific indicators of SQL injection.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Frequent 302 redirects to login pages

    Why it's wrong here

    Frequent HTTP 302 redirects to login pages typically signify issues with session management, authentication failures, or authorization problems, where the application is attempting to re-authenticate an unprivileged or unauthenticated user. While an SQL injection *could* potentially disrupt sessions, the redirect itself is not a direct, primary indicator of a database compromise or injection attempt, but rather a symptom of the application's security controls reacting to an invalid state.

  • Multiple failed connection attempts in server logs

    Why it's wrong here

    Multiple failed connection attempts observed in server logs are a general indicator of various network or application-level issues, such as incorrect credentials during a brute-force attack, network connectivity problems, or misconfigured client applications. SQL injection primarily targets the application's *existing* database connection and query execution, rather than attempting to establish new, failed connections to the database server itself. Therefore, this symptom is not a specific or reliable indicator of an active SQL injection vulnerability.

  • Unexpected rows or columns in query results

    Why this is correct

    The presence of unexpected rows or columns in an application's query results is a strong indicator of a successful UNION-based SQL injection. Attackers leverage the `UNION` operator to combine the results of their malicious query with the legitimate query, thereby extracting data from other tables or databases that were not intended for display. This manipulation directly alters the structure and content of the returned dataset, making it a clear sign of data exfiltration or unauthorized data retrieval.

  • Unusually slow database responses

    Why this is correct

    Unusually slow database responses are a common symptom of time-based blind SQL injection attacks or the execution of computationally intensive malicious queries. Attackers intentionally introduce delays using functions like `SLEEP()` or by crafting complex subqueries that force the database to perform extensive operations, allowing them to infer data based on response times. These deliberate delays, often in the order of several seconds, are a critical indicator that the application's database is being manipulated for data exfiltration or reconnaissance.

  • Database error messages in the application response

    Why this is correct

    The appearance of raw database error messages within an application's user-facing response is a definitive indicator of error-based SQL injection. Attackers intentionally provoke database errors by injecting malformed SQL syntax or functions (e.g., `EXTRACTVALUE`, `UPDATEXML`) that cause the database to return detailed error information, often including parts of the query or even extracted data. This leakage of internal database diagnostics provides attackers with valuable insights and a channel for data exfiltration.

Visual reference

Client Server SYN (seq=100) SYN-ACK (seq=200, ack=101) ACK (ack=201) Connection established — data transfer begins

About these practice questions

Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.