A county purple team studies SQL-injection technique families against a civic license portal in a lab. Which recognition best matches concept-level understanding?
Select an answer to reveal the explanation.
Short Explanation
Think of SQLi like different radio channels—some talk back in-band, some make you listen for blind timing or boolean clues. Label the family right in the lab so the license-portal write-up is not a mush of unrelated bugs.
Full Explanation
Concept-level SQL-injection recognition in a civic license-portal lab requires distinguishing technique families, not treating every database finding as identical. In-band SQL injection returns data or errors through the same channel; blind techniques (boolean or time-based) infer truth without direct data return. Correctly labeling families such as in-band versus blind SQLi improves purple-team write-ups, remediation advice, and training fidelity for county portals.
Claiming only stacked queries exist and blind techniques never appear is factually wrong and leaves analysts blind to common detection patterns. Treating SQL injection as identical to command injection erases a critical taxonomy: SQLi targets the database query path; command injection targets OS/shell execution—different sinks, different fixes. Asserting SQLi applies only to desktop thick clients and never to browser portals ignores the dominant modern web attack surface that municipal apps present.
Exam caveat: family-distinction questions reward in-band vs blind (and related) labels, not collapsing SQLi into CMDi or denying blind methods. Operational check: in lab findings for a license portal, tag the SQLi family explicitly, map it to the observed channel behavior, and avoid mixing shell-command language into a database finding.