SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A developer reports that a search field returns all customer records when they enter a single quote followed by OR 1=1. Security confirms the web app concatenates user input directly into SQL statements. Which remediation is best?
⚠ Common exam trap
Test-takers frequently think a WAF (Option A) is sufficient because it blocks common payloads like `' OR 1=1`, but the exam emphasizes that security must be implemented at the code level, not just at the network perimeter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use parameterized queries or prepared statements in the application code.
Parameterized queries or prepared statements separate SQL logic from user input, preventing the concatenation that allows SQL injection. By using placeholders (e.g., `?` or `:param`) and binding user input as data, the database engine treats the single quote and `OR 1=1` as literal string values, not executable SQL code. This directly remediates the root cause—dynamic SQL construction—without relying on external filters or insecure workarounds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy only a web application firewall and keep the code unchanged.
Why it's wrong here
A WAF inspects HTTP traffic at the edge and can block many SQLi payloads, but it relies on signature matching and heuristics that attackers routinely bypass with encoding, comment injection, or case variation. Because the application still concatenates raw user input into SQL strings, any overlooked pattern or a legitimate request trick can reach the database. This is a reactive, denylist approach that does not eliminate the root cause in code.
- ✓
Use parameterized queries or prepared statements in the application code.
Why this is correct
Parameterized queries separate code from user-supplied data, which prevents injected input from being interpreted as SQL instructions. That directly addresses the flaw described in the scenario and is the most reliable long-term fix. It also scales better than trying to block every malicious pattern with filtering or a perimeter tool. In secure development, fixing the query construction is preferred because it removes the root cause instead of only reducing symptoms at the edge.
- ✗
Store the database password as a salted hash in the application configuration.
Why it's wrong here
Hashing a database password is unrelated to SQL injection; it concerns protecting credentials at rest. To authenticate to the database, the application needs the original password, which would have to be stored reversibly or supplied at runtime, not a salted hash. Even if the password is perfectly secured, an injection flaw persists because the vulnerable query still uses string concatenation for attacker-controlled input.
- ✗
Disable HTTPS so the request body is easier to inspect by network tools.
Why it's wrong here
Disabling HTTPS would eliminate transport-layer confidentiality, allowing network observers to read request bodies, but it has no effect on how the server converts user input into SQL. SQL injection occurs during query construction, which happens server-side after TLS termination, regardless of whether the channel is encrypted. This action actively worsens security by exposing data in transit instead of fixing the flawed query.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer wants to reduce the risk of SQL injection in a new customer search form. Which two changes are the best mitigations? Select two.
easy- ✓ A.Use parameterized queries or prepared statements for all database access.
- ✓ B.Validate and constrain user input before it reaches the database layer.
- C.Store the database password in the page source so the app can connect faster.
- D.Disable TLS so the application can inspect requests more easily.
- E.Allow the application to build SQL statements by concatenating raw user input.
Why A: Parameterized queries and prepared statements separate SQL logic from user-supplied data, ensuring that input is treated as a literal value rather than executable code. This prevents attackers from injecting malicious SQL commands into the query string, as the database driver automatically escapes or binds parameters safely. This is the most effective defense against SQL injection attacks.
Variation 2. A support portal searches customer records by last name. When a tester enters a single quote into the search field, the application returns a database syntax error. Which attack is most likely possible?
easy- ✓ A.SQL injection, because the input may be altering the database query
- B.Cross-site scripting, because the page is executing malicious JavaScript in the browser
- C.Server-side request forgery, because the server is making internal network calls
- D.Cross-site request forgery, because the user is being tricked into submitting a form
Why A: The single quote character is a common SQL injection test payload. When it triggers a database syntax error, it confirms that the input is being directly concatenated into a SQL query without proper sanitization or parameterization. This allows an attacker to break out of the intended query structure and execute arbitrary SQL commands, making SQL injection the most likely attack.
Variation 3. A support portal searches customers by last name using a parameter called q. After one user enters a single quote, the app returns a SQL syntax error. A tester then submits `test' OR '1'='1` and sees every customer record. Which control most directly prevents this issue?
medium- ✓ A.Parameterize the database queries with prepared statements
- B.Encode all output returned to the browser
- C.Add CSRF tokens to the login form
- D.Move the application to a separate VLAN
Why A: The vulnerability is SQL injection, which occurs when user input is directly concatenated into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data by using placeholders, ensuring user input is treated as data only and never executed as code. This directly prevents the attacker from injecting malicious SQL fragments like `' OR '1'='1`.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.