hardMultiple Choice
CAS-004 Practice Question: A mid-sized e-commerce company has recently…
A mid-sized e-commerce company has recently experienced a data breach where customer payment card information was exfiltrated. The security team has identified that the breach originated from a compromised web server that was part of a PCI DSS compliant environment. The server was running outdated software and had several known vulnerabilities. Post-incident analysis reveals that the attacker exploited a SQL injection vulnerability in the order-tracking feature. The incident response team followed NIST SP 800-61 guidelines: they contained the threat, eradicated the malicious code, and restored the server from a known clean backup. However, two weeks after the restoration, the same server is again showing signs of similar malicious activity. The server is still in production and handling credit card transactions. Which of the following is the MOST effective course of action to prevent this recurring compromise?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a thorough code review of the order-tracking feature, implement parameterized queries, and then redeploy the application after passing a static code analysis scan.
The root cause of the breach is a SQL injection vulnerability in the order-tracking feature. Simply patching the server or redeploying the same code (Option B), implementing network segmentation (Option C), or adding a WAF (Option D) are all band-aid solutions that do not address the underlying flawed code. To prevent recurrence, the application code must be reviewed and the SQL injection flaw remediated by using parameterized queries. After fixing the code, redeploying after passing a static code analysis scan ensures the vulnerability is resolved. Therefore, option A is the most effective course of action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conduct a thorough code review of the order-tracking feature, implement parameterized queries, and then redeploy the application after passing a static code analysis scan.
Why this is correct
Parameterised queries eliminate the SQL injection vector by separating code from data, so attacker-supplied input can no longer alter query structure. This directly addresses the root cause the stem identifies — the order-tracking feature's injection flaw — rather than merely restoring a vulnerable server, which is why the compromise recurred after remediation.
- ✗
Replace the web server with a new server running the latest OS and web server version, then redeploy the same web application code.
Why it's wrong here
Replacing hardware leaves the SQL injection flaw in the redeployed order-tracking code, so the same attack recurs. It is tempting because rebuilding from a clean image removes malware and outdated software, and would be right if the vulnerability were purely host-level rather than in the application code itself.
- ✗
Implement network segmentation to isolate the web server and restrict outbound traffic to only essential services.
Why it's wrong here
Segmentation limits lateral movement and exfiltration but does nothing to stop the SQL injection being exploited again on the internet-facing server. It is tempting because PCI DSS mandates network segmentation around cardholder data environments, and it would be correct if the goal were containing blast radius rather than eliminating the injection flaw.
- ✗
Increase logging and deploy a WAF in front of the server with rules to block common SQLi patterns.
Why it's wrong here
A WAF blocking known SQLi signatures is a compensating control that can be bypassed by encoding or novel payloads, and logging only detects recurrence. It is tempting because WAFs are a recognised PCI DSS compensating control where code cannot be fixed, and would be correct if remediation of the vulnerable code were genuinely impossible.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.