ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ135

VerifiedDatabase Penetration Testing Methodology

GenSec Inc., a UK-based company, uses an Oracle database to store all of its data. The company also uses Oracle Database Vault to restrict user access to specific areas of its database. GenSec hired Victor, a senior penetration tester and security auditor, to assess vulnerabilities in the company’s Oracle Database Vault. He was asked to identify every possible vulnerability that could bypass the company’s Oracle DB Vault. Victor attempted different types of attacks to penetrate the company’s Oracle DB Vault and succeeded.

Which of the following attacks could help Victor bypass GenSec’s Oracle DB Vault?

Explanation

SQL injection exploits application-supplied input that is incorporated unsafely into SQL statements, enabling unauthorized access to or manipulation of restricted database data. Oracle documents that Database Vault realms and command rules do not themselves protect database users from SQL-injection risks; an SQL Firewall allow-list policy is required for that protection.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!