mediumMultiple Choice
CAS-004 Practice Question: Designing a secure web application that processes…
A company is designing a secure web application that processes credit card payments. The architect needs to ensure that the application is resilient against SQL injection attacks. Which of the following is the most effective defense?
⚠ Common exam trap
Watch out — candidates often choose stored procedures (Option A) thinking they are inherently safe, but Cisco tests the nuance that stored procedures are only safe if they use parameterized queries internally, not if they concatenate input into dynamic SQL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use parameterized queries or prepared statements for all database interactions.
Parameterized queries (prepared statements) are the most effective defense against SQL injection because they separate SQL logic from user-supplied data at the database driver level. This ensures that user input is always treated as a literal value, never as executable SQL code, regardless of any malicious content. This approach directly prevents the attacker from altering the query structure, which is the root cause of SQL injection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use stored procedures exclusively for database access.
Why it's wrong here
Stored procedures still execute dynamically built SQL if the procedure concatenates parameters, so injection remains possible. They are tempting because they centralise and restrict database access, which is correct when the goal is reducing the application's direct table privileges rather than eliminating injection.
- ✗
Deploy a web application firewall (WAF) with SQL injection rules.
Why it's wrong here
A WAF filters known SQL injection signatures at the HTTP layer, so it cannot stop injection reaching the database through other paths or novel payloads. It is tempting because it adds defence in depth, and would be correct when the requirement is blocking malicious requests at the network edge.
- ✓
Use parameterized queries or prepared statements for all database interactions.
Why this is correct
Parameterised queries separate SQL code from user-supplied data, so injected input is treated as a literal value rather than executable SQL. This structurally prevents injection, unlike input sanitisation or escaping, which rely on filtering and can be bypassed.
- ✗
Implement client-side input validation and sanitize all user input.
Why it's wrong here
Client-side validation runs in the browser, which an attacker fully controls, so it can be stripped or bypassed before the request reaches the server; SQL injection must be stopped server-side via parameterised queries. It is tempting because input validation is a genuine defence-in-depth layer, and would be correct for improving data quality or blocking malformed entries at the UI.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.