ITPEC FE Subject B April 2024 Question 19

The scenario describes two separate issues:
1. Customer accounts compromised via credential stuffing (reusing leaked passwords) → mitigated by 2-factor authentication (already stated in the question).
2. Unauthorized database access with illegal queries and no admin login trace → this is SQL injection, where an attacker manipulates input fields to execute arbitrary SQL commands directly through the web application.

Identifying SQL injection clues:
- "illegal queries executed" — attacker ran arbitrary database commands
- "no trace of administration login" — access bypassed normal authentication
- The web server is the only path to the database (per firewall rules), so the attack came through the application layer

Why WAF is the correct countermeasure:
A Web Application Firewall inspects HTTP requests and blocks malicious patterns (like SQL injection payloads) before they reach the application.

Why not others:
- (a) Connection tapping doesn't explain illegal DB queries; HTTPS is already in place
- (b) Connection tapping + WAF — wrong attack vector for A
- (c) Online brute force + CAPTCHA — account lockout after 5 attempts already exists; doesn't address illegal queries
- (d) Online brute force + password policy — same issue as (c)
- (e) SQL injection + database encryption — encryption protects data at rest, not against query execution via injection

Key rule: When an incident describes unauthorized database queries without authentication, suspect SQL injection; the standard mitigation at the application boundary is a WAF.

AI-generated — may contain errors