hardMultiple Choice
CAS-004 Practice Question: Deploys a new web application that stores…
An organization deploys a new web application that stores sensitive data in a backend database. During a penetration test, the tester discovers that the application is vulnerable to SQL injection via a search field. Which of the following design changes would best mitigate this vulnerability without significantly impacting functionality?
⚠ Common exam trap
CompTIA often tests the misconception that stored procedures are inherently safe against SQL injection, but the trap is that they only prevent injection if they use parameterized queries internally—otherwise, they are just as vulnerable as inline SQL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rewrite the database query to use parameterized prepared statements.
Parameterized prepared statements separate SQL logic from user input, ensuring that any input supplied via the search field is treated strictly as data, not executable code. This directly prevents SQL injection by eliminating the possibility of an attacker altering the query structure, regardless of the input content.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a web application firewall (WAF) to filter malicious payloads.
Why it's wrong here
A WAF filters known payload signatures at the HTTP layer but leaves the vulnerable query construction intact, so obfuscated input can bypass it; it is tempting as a quick compensating control, and would be correct for virtual patching legacy applications that cannot be recoded.
- ✓
Rewrite the database query to use parameterized prepared statements.
Why this is correct
Parameterised prepared statements separate SQL code from user-supplied data, so the search field's input is bound as a value rather than parsed as executable SQL. This neutralises injection at the query layer while preserving the search functionality, satisfying the requirement to mitigate without significantly impacting functionality.
- ✗
Move all database queries to stored procedures.
Why it's wrong here
Stored procedures still concatenate user input into dynamic SQL unless parameterised, so the injection point persists; they are tempting because they centralise query logic and restrict direct table access, and would suit environments enforcing least privilege on base tables.
- ✗
Implement client-side input validation to block special characters.
Why it's wrong here
Client-side validation runs in the browser and is trivially bypassed by tampering with requests, leaving the backend query exposed. It is appropriate for improving user experience and reducing accidental malformed input, but server-side parameterised queries are needed to stop SQL injection reaching the database.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.