hardMultiple ChoiceObjective-mapped
200-201 Practice Question: A large e-commerce company experiences a data…
A large e-commerce company experiences a data breach where customer credit card numbers are stolen. The investigation reveals that an attacker exploited a SQL injection vulnerability in the web application to extract the data from the database. The company's web development team claims they use parameterized queries and prepared statements. However, the forensic analysis shows that the injection occurred through a search functionality that concatenates user input directly into the SQL query. The application logs indicate that the search function was developed by a third-party vendor and integrated into the application six months ago. The company wants to prevent such incidents in the future. Which of the following is the most effective long-term solution?
⚠ Common exam trap
Cisco often tests the distinction between reactive controls (WAF, patching) and proactive process improvements (SSDLC), leading candidates to choose a technical fix like a WAF instead of addressing the root cause of insecure third-party code integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish a secure software development lifecycle (SSDLC) that includes security reviews for all third-party components.
The root cause is a failure in the security review process for third-party components. Even though the company uses parameterized queries elsewhere, the third-party search module concatenates user input directly into SQL queries, bypassing that protection. Establishing an SSDLC with mandatory security reviews for all third-party components ensures that such vulnerabilities are caught before integration, addressing the process gap rather than just the symptom.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace the third-party search module with a custom-developed one.
Why it's wrong here
Custom development may still introduce vulnerabilities if not done securely; the root cause is lack of security review, not the module itself.
- ✓
Establish a secure software development lifecycle (SSDLC) that includes security reviews for all third-party components.
Why this is correct
An SSDLC integrates security into every phase of development, preventing vulnerabilities from being introduced in the first place.
- ✗
Implement a web application firewall (WAF) with OWASP rules.
Why it's wrong here
A WAF can block SQLi attacks but is a compensating control; it does not address the insecure coding practice.
- ✗
Conduct regular vulnerability scans and patch management.
Why it's wrong here
Vulnerability scans would have detected the SQL injection but are reactive; they don't prevent insecure code from being deployed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.