CompTIA Security+ Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D3

  Here’s why SQL injection is the correct answer: SQL Injection (SQLi): Targets the database. •Attacker puts SQL commands into an input field (like a login form). •These commands run on the server and can view, modify, or delete data. •Example: typing ' OR 1=1 -- in a username box to bypass authentication. Cross-Site Scripting (XSS): Targets the user’s browser. •Attacker injects malicious JavaScript into a webpage (through a comment box, search field, etc.). •The script runs in the victim’s browser, usually to steal cookies, sessions, or redirect them. •XSS doesn’t directly manipulate the backend database — it manipulates the user’s interaction with the site. 👉 So, the key difference is where the malicious code executes: SQL injection → server/database side (data manipulation). XSS → client/browser side (user exploitation).

• Chose D36

  The correct answer is: D. SQL injection SQL injection is a type of attack that involves inserting malicious SQL statements into an input field. These statements can then be executed by the database, allowing the attacker to view or manipulate the data. This can lead to unauthorized access to the database, data leakage, or even the modification and deletion of data. Here’s why the other options are not correct in this context: - A. This involves injecting malicious scripts into webpages viewed by other users, but it does not specifically involve running commands that directly view or manipulate data in a database. - B This typically refers to installing applications from unofficial sources, not related to input fields and running commands. -C. This involves exploiting a program by writing more data to a buffer than it can hold, potentially allowing the execution of arbitrary code, but it does not specifically use input fields to run commands on data.

• 15

  SQL injection: SQL injection involves inserting malicious SQL queries into input fields or other user-controllable data sources to manipulate the database backend. By exploiting SQL injection vulnerabilities, attackers can execute arbitrary SQL commands that can view, modify, or delete data stored in the database. This technique directly enables the use of an input field to run commands that manipulate data. Therefore, the correct answer is SQL injection. It allows attackers to execute commands through input fields to manipulate data within a database.