Courseiva
← CRISC
Full test
easyMultiple ChoiceObjective-mapped

CRISC Practice Question: Refer to the exhibit

Exhibit

Error log:
Error: SQL syntax error near ' OR 1=1 --

Refer to the exhibit. What is the most likely risk indicated by this error log?

⚠ Common exam trap

It's easy for candidates to confuse SQL injection with cross-site scripting because both involve input manipulation, but the key distinction is the context: SQL injection targets the database layer via SQL queries, while XSS targets the browser via HTML/JavaScript rendering.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SQL injection

The error log shows a SQL query with a single quote (') in the input, which is a classic indicator of a SQL injection attempt. The query 'SELECT * FROM users WHERE username = 'admin' OR '1'='1'' is attempting to manipulate the SQL statement to bypass authentication or extract data. This directly corresponds to SQL injection (option B), as the attacker is injecting malicious SQL code through user input.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Buffer overflow

    Why it's wrong here

    Buffer overflow is a memory corruption vulnerability, not related to this error.

  • ✓

    SQL injection

    Why this is correct

    The error line contains a SQL injection payload (' OR 1=1 --), indicating an attempt to exploit a SQL injection vulnerability.

  • ✗

    Denial of service

    Why it's wrong here

    A single SQL error does not indicate a denial of service attack.

  • ✗

    Cross-site scripting

    Why it's wrong here

    Cross-site scripting involves injecting client-side scripts, not SQL syntax errors.

About these practice questions

One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.