SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A development team wants to allow users to search orders by customer name and date range. Logs show the team currently concatenates the filter values into SQL strings. Which change best reduces SQL injection risk without removing the search feature?
⚠ Common exam trap
Watch out — candidates often choose input escaping (Option A) because it seems like a direct fix for the apostrophe problem, but they fail to recognize that parameterized queries are the only comprehensive defense that eliminates the entire class of SQL injection vulnerabilities regardless of input format.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use parameterized queries or prepared statements for the search filters.
Parameterized queries (also known as prepared statements) separate SQL logic from user data by sending the query structure and parameters independently to the database. This ensures that user-supplied filter values are always treated as data, never as executable SQL code, which completely prevents SQL injection even if the input contains malicious characters like apostrophes or SQL keywords.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escape apostrophes in the input before building the SQL statement.
Why it's wrong here
Escaping apostrophes is a blacklist-based defense that only handles a single character and fails against broader injection vectors. Attackers can bypass it with encoded payloads (e.g., UTF-8 or URL encoding), multi-byte characters, or SQL constructs that do not require quotes, such as numeric or boolean conditions. It also breaks when user input is re-used in different database contexts, leading to incomplete coverage.
- ✓
Use parameterized queries or prepared statements for the search filters.
Why this is correct
Parameterized queries separate code from data, so user input is treated as values rather than executable SQL. This allows the search function to remain flexible while dramatically reducing injection risk. Prepared statements are the preferred fix because they address the root cause instead of relying on brittle string handling.
- ✗
Disable database error messages so attackers cannot see query details.
Why it's wrong here
Suppressing database error messages prevents attackers from seeing query syntax details, but it does nothing to alter the vulnerable SQL construction. With the flaw still present, a skilled attacker can exploit blind SQL injection by observing differences in response timing, HTTP status codes, or true/false conditions. Error masking is a useful defense-in-depth control, not a remediation for the root cause.
- ✗
Place the application behind a VPN so only internal users can run searches.
Why it's wrong here
Placing the application behind a VPN changes the network perimeter but leaves the application's SQL construction logic unchanged. Any authenticated user—or an attacker who compromises a VPN account—can still inject arbitrary SQL through the search filters. The vulnerability is in the code itself, and network-level access controls cannot substitute for secure query parameterization.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst discovers that an organization's web application is vulnerable to SQL injection. The application uses a legacy database driver that does not support parameterized queries. Which of the following is the BEST mitigation to prevent this vulnerability?
medium- A.Implement a web application firewall (WAF) to filter malicious input.
- ✓ B.Update the database driver to a version that supports parameterized queries.
- C.Encode all user input using HTML encoding.
- D.Disable error messages that reveal database schema.
Why B: The root cause of the SQL injection vulnerability is the legacy database driver that does not support parameterized queries. Updating the driver to a modern version that supports parameterized queries (also known as prepared statements) allows the application to separate SQL logic from user-supplied data, effectively preventing SQL injection at the database layer. This addresses the fundamental flaw rather than relying on external filtering or encoding.
Variation 2. A security analyst is reviewing the results of a dynamic application security test (DAST) on a new e-commerce application. The report indicates that the application's product search functionality is vulnerable to blind SQL injection. The analyst is tasked with recommending a remediation to the development team. The developers currently concatenate user input directly into SQL queries. Which of the following recommendations would most effectively and permanently mitigate this vulnerability?
medium- A.Implement a web application firewall (WAF) rule to block suspicious SQL keywords in search parameters.
- B.Sanitize user input by escaping single quotes and other special characters before concatenation.
- ✓ C.Replace dynamic SQL queries with parameterized prepared statements.
- D.Encode all user input using HTML entity encoding before database operations.
Why C: Parameterized prepared statements separate SQL logic from user input, ensuring that input is always treated as data, not executable code. This permanently prevents SQL injection by design, regardless of the input content, unlike input filtering or WAF rules which can be bypassed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.