Exam 350-701 topic 1 question 8 discussion

should be A

This is a tricky question, and I believe the provided answer is correct and here is why. They ask what is the flaw that caused the attacker to exploit this vulnerability? I agree that the attacker uses the web application or the user input to exploit the vulnerability, and give commands to connect to the database and get everything needed about the database. But what where is the actual flaw? Was it A. the web application and the user input? No, it’s not, or it would be XSS vulnerability. The attacker leveraged a flaw in the Database, using the web application or the user input as a way to communicate with the Database and extract all the info about the database. With that being said, I believe that the provided answer is correct, and I will go with C.

As others have highlighted already, the "flaw" would refer to the vulnerability which in this example would be the user input validation (or lack of). https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-dcnm-sql-inj-OAQOObP.html This is also verified in the above link... "CVE-2021-1248: Cisco DCNM SQL Injection Vulnerability A vulnerability in a REST API endpoint of Cisco DCNM could allow an authenticated, remote attacker with administrative privileges to execute arbitrary SQL commands on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the API. An attacker with administrative privileges could exploit this vulnerability by sending a crafted request to the API"

Which "flaw" does. So its cause in my understanding

Exploiting input validation at the source and destination. It isn't a flaw within the database itself.

I believe the answer is C. The Database is unable to sanitize the data sent to it through the web page/application as it relies heavily on the web page/application to sanitize the code. That is the databases flaw. The attacker is leveraging the fact that the database can't do anything to prevent the attacker from sending the code. Very tricky question...

Exploiting no data validation

for me the answer is C, because you can have systems which is using web to connect into database, so all the queries are coming from web to database, the user wont exploit web but database through web, so for me I will go with Database instead of web.

To prevent SQL injection one means of preventing is input validation.

definitely A

should be A

Answer is definitely A.

should be A

Answer is definitely A. Input validation is the vulnerability, not the database.

The answer is A

A https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-dcnm-sql-inj-OAQOObP.html

I go with A