A Recently Concluded Penetration Test Revealed That a Legacy Web

question 135

Multiple Choice

A recently concluded penetration test revealed that a legacy web application is vulnerable to SQL injection. Research indicates that completely remediating the vulnerability would require an architectural change, and the stakeholders are not in a position to risk the availability on the application. Under such circumstances, which of the following controls are low-effort, short-term solutions to minimize the SQL injection risk? (Choose two.)

• A) Identity and eliminate inline SQL statements from the code.
• B) Identify and eliminate dynamic SQL from stored procedures.
• C) Identify and sanitize all user inputs.
• D) Use a whitelist approach for SQL statements.
• E) Use a blacklist approach for SQL statements.
• F) Identify the source of malicious input and block the IP address.

---

Definitions:

Reaction Formation

A psychological defense mechanism where an individual unconsciously replaces unacceptable thoughts or feelings with their opposites.

Defense Mechanism

Psychological strategies employed by individuals, often unconsciously, to protect themselves from anxiety-producing thoughts, feelings, or situations.

Denial

A psychological strategy where an individual evades facing a personal issue or accepting the truth by rejecting the presence of the problem or reality.

Painful Realities

The harsh or uncomfortable truths about life that individuals must accept or confront.