CEH Web Application and Injection Attacks Practice Question
Which TWO of the following are types of SQL injection? (Select 2)
⚠ Common exam trap
CEH often tests the overlap between XSS and SQLi taxonomies — candidates see 'Stored' and 'Reflected' and mistakenly select them as SQLi types when those are XSS categories.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Union-based
Union-based SQL injection (C) is a correct type because it uses the SQL UNION operator to append a crafted SELECT statement to the original query, allowing the attacker to retrieve data from other tables in the same result set. Blind boolean-based SQL injection (D) is also correct because the application returns no data or error details, so the attacker sends true/false conditions and infers information from differences in the application's response. The other options are not SQL injection types: Stored (A) and Reflected (E) are categories of cross-site scripting (XSS), and DOM-based (B) is also an XSS classification that manipulates the client-side DOM rather than injecting SQL into a database query.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stored
Why it's wrong here
Stored is a type of Cross-Site Scripting (XSS), not SQL injection. In a Stored XSS attack, malicious script is permanently injected into a target application's database or other persistent storage. When a legitimate user later retrieves this stored data, the malicious script is delivered to their browser and executed, leading to session hijacking, defacement, or redirection. This differs fundamentally from SQL injection, which directly manipulates database queries.
- ✗
DOM-based
Why it's wrong here
DOM-based is a specific type of Cross-Site Scripting (XSS), distinct from SQL injection. This vulnerability arises when client-side script processes data from an untrusted source, such as the URL fragment or document.referrer, and writes it into the Document Object Model (DOM) without proper sanitization. The malicious payload is executed entirely within the victim's browser, without ever being sent to the server or interacting with the database in a server-side query manipulation context.
- ✓
Union-based
Why this is correct
Union-based SQL injection is an in-band technique where an attacker leverages the UNION SELECT SQL operator to combine the results of the original legitimate query with a malicious query. This allows the attacker to retrieve data from other tables or databases within the same database server, and have it returned directly in the application's HTTP response. The attacker can then extract sensitive information by carefully crafting the injected SELECT statement.
- ✓
Blind boolean-based
Why this is correct
Blind boolean-based SQL injection is a technique used when an attacker cannot directly see the results of their injected SQL queries in the application's response. Instead, the attacker sends SQL queries that force the application to return a different result based on a true or false condition. By observing subtle changes in the application's behavior, such as page content variations or error messages, the attacker can infer data character by character.
- ✗
Reflected
Why it's wrong here
Reflected is a type of Cross-Site Scripting (XSS), not SQL injection. In a Reflected XSS attack, the malicious script is not permanently stored but is instead "reflected" off a web server. The attacker crafts a URL containing the malicious payload, and when a victim clicks this link, the server processes the request and includes the script in its response, causing it to execute in the victim's browser. This is a non-persistent attack targeting the user's browser, not the backend database.
Go deeper
Related to this question
Learn chapter
SQL Injection
Key term
Cross Site Scripting XSS
Cross Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users, enabling theft of data or session hijacking.
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
About these practice questions
One of 913 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.