Web, Application & SQL Injection Attacks
32 practice questions with explanations — 15 free to try
2 of these 32 questions are in the free 15-question taster · the full topic is part of Premium
PassNova has 32 Certified Ethical Hacker (CEH) practice questions on Web, Application & SQL Injection Attacks, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Web, Application & SQL Injection Attacks: example questions & answers
2 worked examples with answers and explanations below. Try 15 Certified Ethical Hacker (CEH) questions free in the browser; the full 32-question Web, Application & SQL Injection Attacks bank is part of PassNova Premium.
Which input would most clearly indicate a tester is attempting a classic SQL injection on a login form?
- A' OR '1'='1' --✓
- B<script>alert(1)</script>
- C../../etc/passwd
- D%0d%0aSet-Cookie: x=1
Answer: The payload ' OR '1'='1' -- manipulates the SQL WHERE clause so the condition is always true and comments out the rest, a textbook authentication-bypass SQL injection.
Which OWASP-recognised vulnerability allows an attacker to inject client-side scripts that execute in other users' browsers?
- ACross-Site Scripting (XSS)✓
- BSQL Injection, which manipulates database queries
- CCross-Site Request Forgery, which forces an unwanted request
- DDirectory traversal, which reads files outside the web root
Answer: Cross-Site Scripting (XSS) injects malicious scripts into web pages that are then executed in the browsers of other users, enabling session theft and defacement.