hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A mid-sized e-commerce company has recently…
A mid-sized e-commerce company has recently experienced a data breach where customer payment card information was exfiltrated. The security team has identified that the breach originated from a compromised web server that was part of a PCI DSS compliant environment. The server was running outdated software and had several known vulnerabilities. Post-incident analysis reveals that the attacker exploited a SQL injection vulnerability in the order-tracking feature. The incident response team followed NIST SP 800-61 guidelines: they contained the threat, eradicated the malicious code, and restored the server from a known clean backup. However, two weeks after the restoration, the same server is again showing signs of similar malicious activity. The server is still in production and handling credit card transactions. Which of the following is the MOST effective course of action to prevent this recurring compromise?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a thorough code review of the order-tracking feature, implement parameterized queries, and then redeploy the application after passing a static code analysis scan.
The root cause of the breach is a SQL injection vulnerability in the order-tracking feature. Simply patching the server or redeploying the same code (Option B), implementing network segmentation (Option C), or adding a WAF (Option D) are all band-aid solutions that do not address the underlying flawed code. To prevent recurrence, the application code must be reviewed and the SQL injection flaw remediated by using parameterized queries. After fixing the code, redeploying after passing a static code analysis scan ensures the vulnerability is resolved. Therefore, option A is the most effective course of action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conduct a thorough code review of the order-tracking feature, implement parameterized queries, and then redeploy the application after passing a static code analysis scan.
Why this is correct
Directly addresses the SQLi vulnerability at the code level.
- ✗
Replace the web server with a new server running the latest OS and web server version, then redeploy the same web application code.
Why it's wrong here
The application code still contains the SQLi vulnerability.
- ✗
Implement network segmentation to isolate the web server and restrict outbound traffic to only essential services.
Why it's wrong here
Segmentation limits blast radius but does not fix the vulnerability.
- ✗
Increase logging and deploy a WAF in front of the server with rules to block common SQLi patterns.
Why it's wrong here
WAFs can be bypassed and do not fix the underlying code.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.