ITPEC FE Subject B April 2024 Question 19

Topic: Security Scenarios

From the answer group below, select the most appropriate combination of answers to be inserted into A and B in the following description.

Company Y is an online retailer providing e-commerce web applications for customers to make purchases online and also allows customers to post product reviews. The web application was developed and maintained in-house. The properties of the e-commerce web application are shown in Figure 1.

•The web application resides on the web server in the demilitarized zone (DMZ), and the database used by the web application resides on the database server in the internal network.•The firewall is properly configured, the customers can only access the web server in the DMZ, and the database can only be accessed from the web server.•The web server allows access only through the HTTPS service, and the certificate is properly configured.•The customers can login using their registered email address and password.•The password is hashed and stored on the database.•The customer is locked out and notified by email with a recovery link if there are 5 consecutive incorrect login attempts.•Third-party payment gateways are used to perform financial transactions. The credit card information of customers is not stored in the database.•There is a password recovery system which allows the customer to reset the password through a password recovery link sent to the registered email address.

Figure 1 Properties of the e-commerce web application

Due to recent incidents with multiple customers reporting that their accounts were compromised, the management tasked the IT team to investigate and address the issues. The IT team found that many customer accounts logins were unnoticed by the actual account owners, and some of the accounts were used to post fake reviews. The IT team also discovered unauthorized access to the database with illegal queries executed with no trace of administration login.

The IT team concluded that the incidents are most likely caused by using the same password on other leaked sites and A. They proposed to implement 2-factor authentication and B to mitigate respective issues in the future. The management then agreed to the plan, and the solutions was implemented accordingly.

Answer group

OptionAB

Explanation

A: SQL injection, B: web application firewall — the illegal database queries without any administrator login came in through the web application, and a WAF filters that input.

The report describes two separate problems:

  • •Logins the owners never noticed, then fake reviews: passwords reused from other leaked sites, which 2-factor authentication addresses.
  • •Illegal queries on the database with no administrator login: the firewall lets only the web server reach the database, so the queries must have been issued by the web application itself, fed crafted input. That is SQL injection (blank A).

A web application firewall inspects HTTP requests and blocks those that carry injection payloads before they reach the application, so it mitigates the second problem (blank B).

Answer (f)

Why not others:

  • •(a) and (b) — connection tapping is eavesdropping on traffic, which already runs over properly configured HTTPS; eavesdropping reveals data but does not execute queries
  • •(c) and (d) — online brute force is already stopped by the lockout after 5 failed attempts and cannot explain queries on the database; CAPTCHA and a stricter password policy only slow password guessing
  • •(a) and (e) — database encryption protects stored data, but injected queries run through the application, which reads the data decrypted anyway

Key rule: Database queries that appear without any login point to SQL injection through the application; stop it at the application layer (input validation, parameterised queries, a WAF), since encryption and login controls do not.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.