Unit 5 Review

The following browser request displays the search results of all fiction books that are available to purchase from an online book store.

https://insecure-website.com/products?category=Fiction

Which of the following browser requests correctly attempts to use a SQL injection to extract additional data from the original request?

• //insecure-website.com/products?category=Fiction’ or 1=1–’

• //insecure-website.com/products?category=Fiction’ and 1=1--'

• //insecure-website.com/products?category=Fiction’ where 1=1–’

• //insecure-website.com/products?category=Fiction’ display 1=1–’

Which of the statements is true based on the following query?

SELECT name, occupation FROM Employee WHERE age < 45;

The name of the database is ‘occupation’.

There is a column for Employee in the table.

There is a column for age in the table.

The name of the database is name.

• The name of the database is ‘occupation’.

• There is a column for Employee in the table

• There is a column for age in the table.

• The name of the database is name.

Which is not true according to the following query?

SELECT name FROM Users WHERE id = 90;

• The name of the table is Users.

• There is a column for name in the table.

• There is a row for id in the table.

• The name column will be displayed as a result of this query for all records where the id = 90.

Which query will return the entire Gamers table?

• SELECT all FROM Gamers;

• SELECT * FROM Gamers;

• SELECT DATABASE FROM Gamers;

• SELECT ALL FROM Gamers;

Which type of SQL injection attack occurs by adding a condition that is always true to a query to extract additional information from the database?

• Error-based SQLi

• Union-based SQLi

• Blind SQLi

• Conditional SQLi

Some of the best ways to prevent or at least mitigate a SQLi attack are to

A. Keep data separate from commands and queries

B. Use a safe API

C. Reduce the amount of SQL used overall

D. Use server-side input validation

E. Use other SQL controls to prevent mass disclosure of records

F. Avoid leaving any raw SQL in the code G. Have SQL reside behind multiple layers in the code base and not accessible by the site

• C, E, F, and G

• A, B, and D

• A, B, C, and D

• All options are correct.

Which operator means “not equal to” in SQL?

• x=

• =!

• <>

• /=

A database is always comprised of

• personally identifying information.

• tables with rows and columns.

• lots of cryptographically stored symbols.

• lots of little databases.

Which term is used to describe the logical structure of a database?

• Table

• Record

• Schema

• Attribute

In a database, columns and rows correspond to...

• attributes and records

• 1s and 0s

• tables and names

• SQL and HTML