CEH Web Application and Injection Attacks Practice Question
Which TWO of the following attacks can be prevented by properly validating and sanitizing user input? (Select 2)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection
SQL injection and XSS are both injection attacks that can be prevented by input validation and sanitization. CSRF requires tokens, and clickjacking requires frame-busting headers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-Site Request Forgery (CSRF)
Why it's wrong here
Cross-Site Request Forgery (CSRF) attacks exploit the trust a web application has in a user's browser, compelling the browser to send an unauthorized request to a trusted site. Input validation focuses on the legitimacy of the data itself, not the legitimacy of the request's origin or the user's intent. Therefore, proper prevention relies on implementing anti-CSRF tokens, which verify that the request originated from the legitimate application and not from an attacker's site, rather than scrutinizing the input data.
- ✓
SQL injection
Why this is correct
SQL injection attacks occur when an attacker inserts malicious SQL code into user input fields, which is then executed by the database. Proper input validation and sanitization are highly effective against this threat. Techniques such as using parameterized queries (prepared statements) or escaping special characters ensure that user-supplied data is treated strictly as data literals, preventing it from being interpreted as executable SQL commands and neutralizing the injection attempt.
- ✗
Man-in-the-Middle (MitM) attack
Why it's wrong here
A Man-in-the-Middle (MitM) attack involves an attacker intercepting and potentially altering communications between two parties without their knowledge. This type of attack operates primarily at the network or transport layer, focusing on compromising the confidentiality and integrity of data in transit. Input validation, which occurs at the application layer to scrutinize user-supplied data, cannot prevent an attacker from interposing themselves in the communication channel or from manipulating encrypted traffic if the underlying transport security (like TLS/SSL) is compromised.
- ✗
Clickjacking
Why it's wrong here
Clickjacking, or UI redressing, tricks users into clicking on a hidden, malicious element by overlaying a transparent iframe on a legitimate webpage. This attack manipulates the user interface and browser rendering behavior, rather than exploiting vulnerabilities related to data input or processing. Consequently, input validation is ineffective; defenses against clickjacking primarily involve implementing HTTP security headers such as `X-Frame-Options` or the `Content-Security-Policy` (CSP) `frame-ancestors` directive, which control how web pages can be embedded.
- ✓
Cross-Site Scripting (XSS)
Why this is correct
Cross-Site Scripting (XSS) attacks inject malicious client-side scripts into web pages, which are then executed in the victim's browser. This vulnerability arises when an application fails to properly validate, sanitize, or encode user-supplied input before rendering it back to the user. By rigorously sanitizing input to remove or neutralize executable script tags and encoding output to ensure user data is displayed as text rather than interpreted as active code, applications can effectively prevent XSS vulnerabilities.
Go deeper
Related to this question
Learn chapter
SQL Injection
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
Key term
CSRF
Cross-Site Request Forgery is an attack that tricks a user into performing an unwanted action on a web application where they are currently authenticated.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.