easyMultiple Choice
FC0-U71 Practice Question: A web application constructs SQL queries by…
A web application constructs SQL queries by concatenating user input directly. What is the primary security risk?
⚠ Common exam trap
Candidates often confuse SQL injection with cross-site scripting (XSS) because both involve user input, but XSS targets the browser with scripts, while SQL injection targets the database server directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection
When a web application constructs SQL queries by concatenating user input directly, an attacker can inject malicious SQL code into the query. This allows the attacker to manipulate the database, such as by bypassing authentication, retrieving unauthorized data, or executing arbitrary commands. This is the classic definition of SQL injection, which exploits the lack of input sanitization or parameterized queries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SQL injection
Why this is correct
Concatenating user input into SQL statements lets attackers inject crafted syntax that the database executes as code, altering query logic to bypass authentication or expose data. SQL injection is the primary risk created by this unsafe construction pattern.
- ✗
Denial of service
Why it's wrong here
Concatenated input enables SQL injection, letting attackers alter query logic to read or modify data. Denial of service is a separate availability attack, and would be the answer if the stem described resource exhaustion or query flooding rather than query manipulation.
- ✗
Cross-site scripting
Why it's wrong here
Cross-site scripting arises from unescaped output rendered in a browser, not from server-side SQL string concatenation. XSS would be correct if the stem described user input reflected into HTML without encoding, executing script in victims' sessions.
- ✗
Buffer overflow
Why it's wrong here
Buffer overflows stem from unchecked memory writes in languages like C, not from database query construction. A buffer overflow would be the answer if the stem described fixed-size memory buffers being overrun by oversized input.
Go deeper
Related to this question
About these practice questions
Courseiva writes every FC0-U71 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This FC0-U71 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the FC0-U71 exam.