200-201 Question 73
Single answerA cybersecurity analyst is investigating a recent attack on a company’s web application. The attacker exploited a vulnerability in the application’s input validation process to execute arbitrary SQL commands and retrieve sensitive customer data. The exploit required the attacker to craft specific SQL payloads and bypass application firewall rules. Based on this scenario, what is the likely attack complexity level, and why?
- A
Low complexity because the attack used a well-known vulnerability with publicly available tools.
- B
Low complexity because the attacker did not require any privileges to execute the attack.
- C
High complexity because the attacker needed advanced technical knowledge to craft the payload and bypass defenses.
- D
Medium complexity because the attacker performed some reconnaissance but used automated tools to execute the attack.
Show answer and explanation
Correct answer: C
Explanation
Attack complexity refers to the level of effort, skill, and resources required to execute an attack successfully. In this scenario, the attacker had to craft specific SQL payloads and bypass application firewall rules, which indicates a high level of technical expertise and effort. These factors classify the attack as high complexity.
- A. Incorrect.
Low complexity is incorrect because the attacker needed to bypass defenses and craft specific payloads, which requires more effort and expertise than a low-complexity attack.
- B. Incorrect.
Low complexity is incorrect because the lack of required privileges does not necessarily determine attack complexity. The need for payload crafting and firewall bypassing indicates a higher level of complexity.
- C. Correct.
High complexity is correct because the attacker demonstrated advanced technical knowledge by crafting specific SQL payloads and bypassing the application firewall, which increases the overall complexity of the attack.
- D. Incorrect.
Medium complexity is incorrect because the scenario does not explicitly mention the use of automated tools and emphasizes manual effort in crafting payloads and bypassing defenses, indicating higher complexity.