hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Deploys a new web application that stores…
An organization deploys a new web application that stores sensitive data in a backend database. During a penetration test, the tester discovers that the application is vulnerable to SQL injection via a search field. Which of the following design changes would best mitigate this vulnerability without significantly impacting functionality?
⚠ Common exam trap
CompTIA often tests the misconception that stored procedures are inherently safe against SQL injection, but the trap is that they only prevent injection if they use parameterized queries internally—otherwise, they are just as vulnerable as inline SQL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rewrite the database query to use parameterized prepared statements.
Parameterized prepared statements separate SQL logic from user input, ensuring that any input supplied via the search field is treated strictly as data, not executable code. This directly prevents SQL injection by eliminating the possibility of an attacker altering the query structure, regardless of the input content.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a web application firewall (WAF) to filter malicious payloads.
Why it's wrong here
A WAF is a layer of defense but can be bypassed and does not fix the underlying code vulnerability.
- ✓
Rewrite the database query to use parameterized prepared statements.
Why this is correct
Parameterized queries ensure user input is treated as data, not executable code, preventing SQL injection.
- ✗
Move all database queries to stored procedures.
Why it's wrong here
Stored procedures can still be vulnerable if they dynamically construct SQL; they are not a guaranteed fix.
- ✗
Implement client-side input validation to block special characters.
Why it's wrong here
Client-side validation is easily bypassed; server-side validation is needed, but even then, blacklisting is not reliable.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.