As an IT Security Analyst, you'five been asked to review the security measures of an e-commerce website that relies on a SQL database for storing sensitive customer data. Recently, an anonymous tip has alerted you to a possible threat: a seasoned hacker who specializes in SQL Injection attacks may be targeting your system. The site already employs input validation measures to prevent basic injection attacks, and it blocks any user inputs containing suspicious patterns. However, this hacker is known to use advanced SQL Injection techniques. Given this situation, which of the following strategies would the hacker most likely adopt to bypass your security measures?

A. The hacker might employ a 'blind' SQL Injection attack, taking advantage of the application's true or false responses to extract data bit by bit

B. The hacker may resort to a DDoS attack instead, attempting to crash the server and thus render the e-commerce site unavailable

C. The hacker may try to use SQL commands which are less known and less likely to be blocked by your system's security

D. The hacker could deploy an 'out-of-band' SQL Injection attack, extracting data via a different communication channel, such as DNS or HTTP requests










Correct Answer: A

This question is in 312-50v12 exam
For getting CEH Certificate