mediumMultiple SelectObjective-mapped
CAS-004 Practice Question: Which TWO of the following are secure coding…
Which TWO of the following are secure coding practices to prevent SQL injection?
⚠ Common exam trap
A common misconception is that stored procedures are inherently safe against SQL injection, but if the stored procedure uses dynamic SQL with concatenated input (e.g., EXEC('SELECT * FROM Users WHERE UserName = ''''' + @Input + ''''''), it remains vulnerable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using an ORM that automatically parameterizes queries
Object-Relational Mapping (ORM) frameworks like Hibernate or Entity Framework, when configured to use parameterized queries, automatically separate SQL code from data. This prevents an attacker from injecting malicious SQL statements because user input is always treated as a parameter value, never as executable code. The ORM's internal query builder generates parameterized SQL statements under the hood, ensuring that even if input contains SQL metacharacters, they are safely escaped or bound.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escaping all single quotes in user input
Why it's wrong here
Escaping can be incomplete or bypassed with alternative encodings.
- ✗
Validating input against a whitelist of allowed characters
Why it's wrong here
Input validation reduces risk but is not a primary defense; it can be too restrictive or easily bypassed.
- ✓
Using an ORM that automatically parameterizes queries
Why this is correct
Modern ORMs use parameterization internally, preventing SQL injection.
- ✓
Using parameterized queries with placeholders
Why this is correct
Parameterized queries with placeholders enforce strict separation between SQL command logic and user-supplied data by pre-compiling the query structure before any input is bound. This prevents an attacker from altering the intended SQL syntax, directly satisfying the stem’s requirement to block injection. Unlike concatenated strings, placeholders ensure input is always treated as a literal value, never as executable code.
- ✗
Using stored procedures that accept user input directly
Why it's wrong here
If the stored procedure concatenates input into dynamic SQL, it remains vulnerable.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.