mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Designing a secure web application that processes…
A company is designing a secure web application that processes credit card payments. The architect needs to ensure that the application is resilient against SQL injection attacks. Which of the following is the most effective defense?
⚠ Common exam trap
Watch out — candidates often choose stored procedures (Option A) thinking they are inherently safe, but Cisco tests the nuance that stored procedures are only safe if they use parameterized queries internally, not if they concatenate input into dynamic SQL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use parameterized queries or prepared statements for all database interactions.
Parameterized queries (prepared statements) are the most effective defense against SQL injection because they separate SQL logic from user-supplied data at the database driver level. This ensures that user input is always treated as a literal value, never as executable SQL code, regardless of any malicious content. This approach directly prevents the attacker from altering the query structure, which is the root cause of SQL injection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use stored procedures exclusively for database access.
Why it's wrong here
Stored procedures can still be vulnerable if they concatenate input.
- ✗
Deploy a web application firewall (WAF) with SQL injection rules.
Why it's wrong here
WAFs provide defense in depth but can be bypassed; not the most effective standalone defense.
- ✓
Use parameterized queries or prepared statements for all database interactions.
Why this is correct
Parameterized queries ensure data is treated as data, effectively preventing SQL injection.
- ✗
Implement client-side input validation and sanitize all user input.
Why it's wrong here
Client-side validation is easily bypassed; server-side sanitization may still have flaws.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.