CEH Web Application and Injection Attacks Practice Question
Which THREE of the following are common indicators of an SQL injection attack? (Choose 3.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unexpected rows or columns in query results
SQL injection attacks commonly cause unexpected rows or columns in query results due to manipulated queries, unusually slow database responses from resource-intensive operations like UNION or subqueries, and database error messages that reveal syntax or structure to the attacker. Frequent 302 redirects and many failed connection attempts are not typical or specific indicators of SQL injection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Frequent 302 redirects to login pages
Why it's wrong here
Frequent HTTP 302 redirects to login pages typically signify issues with session management, authentication failures, or authorization problems, where the application is attempting to re-authenticate an unprivileged or unauthenticated user. While an SQL injection *could* potentially disrupt sessions, the redirect itself is not a direct, primary indicator of a database compromise or injection attempt, but rather a symptom of the application's security controls reacting to an invalid state.
- ✗
Multiple failed connection attempts in server logs
Why it's wrong here
Multiple failed connection attempts observed in server logs are a general indicator of various network or application-level issues, such as incorrect credentials during a brute-force attack, network connectivity problems, or misconfigured client applications. SQL injection primarily targets the application's *existing* database connection and query execution, rather than attempting to establish new, failed connections to the database server itself. Therefore, this symptom is not a specific or reliable indicator of an active SQL injection vulnerability.
- ✓
Unexpected rows or columns in query results
Why this is correct
The presence of unexpected rows or columns in an application's query results is a strong indicator of a successful UNION-based SQL injection. Attackers leverage the `UNION` operator to combine the results of their malicious query with the legitimate query, thereby extracting data from other tables or databases that were not intended for display. This manipulation directly alters the structure and content of the returned dataset, making it a clear sign of data exfiltration or unauthorized data retrieval.
- ✓
Unusually slow database responses
Why this is correct
Unusually slow database responses are a common symptom of time-based blind SQL injection attacks or the execution of computationally intensive malicious queries. Attackers intentionally introduce delays using functions like `SLEEP()` or by crafting complex subqueries that force the database to perform extensive operations, allowing them to infer data based on response times. These deliberate delays, often in the order of several seconds, are a critical indicator that the application's database is being manipulated for data exfiltration or reconnaissance.
- ✓
Database error messages in the application response
Why this is correct
The appearance of raw database error messages within an application's user-facing response is a definitive indicator of error-based SQL injection. Attackers intentionally provoke database errors by injecting malformed SQL syntax or functions (e.g., `EXTRACTVALUE`, `UPDATEXML`) that cause the database to return detailed error information, often including parts of the query or even extracted data. This leakage of internal database diagnostics provides attackers with valuable insights and a channel for data exfiltration.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.