CompTIA PenTest+ Practice Test

What is the method of altering SQL commands by embedding code within input fields to manipulate queries?

1. Code Injection

2. SQL Injection

3. Directory Traversal

4. Buffer Overflow

The correct answer is: SQL Injection

The method of altering SQL commands by embedding code within input fields to manipulate queries is known as SQL Injection. This technique involves injecting malicious SQL code into a query by taking advantage of input fields that do not properly sanitize user inputs. When an application directly incorporates user-inputted data into SQL statements without adequate validation or parameterization, it becomes vulnerable to this type of attack. Attackers can exploit such vulnerabilities to execute arbitrary SQL code, allowing them to manipulate database queries. This can lead to unauthorized access to sensitive data, data modification, or even deletion of data within the database. The fundamental characteristic of SQL Injection is that it specifically targets SQL statements and databases, distinguishing it from other types of attacks. The other options, while related to security vulnerabilities, represent different types of attacks. Code Injection refers to a broader category of attacks where arbitrary code is executed. Directory Traversal is an attack that allows unauthorized access to files and directories on a server, and Buffer Overflow involves sending more data to a buffer than it can hold, potentially leading to arbitrary code execution in the context of memory manipulation.