SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Implement a web application firewall (WAF) to filter malicious input.

  Why it's wrong here

  A WAF can provide some protection by detecting and blocking common SQL injection patterns, but it is a compensating control and can be bypassed. It does not fix the underlying vulnerability in the application code.

  When this WOULD be correct

  A WAF would be the best mitigation if the question stated that the database driver cannot be updated (e.g., due to vendor lock-in or legacy system constraints) and the organization needs a compensating control to reduce risk.

• ✓

  Update the database driver to a version that supports parameterized queries.

  Why this is correct

  Parameterized queries, also known as prepared statements, separate the SQL statement structure from user-supplied data by sending the query template to the database first and then binding input values as parameters. This ensures that even if an attacker submits malicious SQL fragments, they are treated strictly as data values, never as executable command text. Updating the database driver to a version that fully supports these APIs is the definitive root-cause fix, because it eliminates the injection vulnerability instead of merely detecting or filtering attack payloads.

• ✗

  Encode all user input using HTML encoding.

  Why it's wrong here

  HTML encoding is an output-encoding technique designed to neutralize cross-site scripting (XSS) by converting characters like <, >, and & into HTML entities before the browser renders them. SQL injection, however, occurs during database query parsing, where the database engine interprets the raw input as part of the SQL grammar—HTML entities have no special meaning to SQL and will not prevent a malicious clause from executing. Moreover, applying HTML encoding to input can corrupt legitimate data (e.g., storing &lt; instead of <) and provides zero protection at the database layer, making it a fundamentally different and ineffective countermeasure for this threat.

  When this WOULD be correct

  This would be correct if the question asked for the best mitigation against cross-site scripting (XSS) in a web application that reflects user input in HTML output.

• ✗

  Disable error messages that reveal database schema.

  Why it's wrong here

  Disabling verbose database error messages is a valid defensive hardening step that reduces information disclosure by preventing attackers from seeing table names, column names, or query syntax in application responses. However, it does not alter the execution of the injected SQL—the malicious query still runs and may return data or modify records; it only deprives the attacker of visible clues. Skilled attackers can exploit blind SQL injection techniques, such as time-based delays or boolean-based page differences, to enumerate the schema and exfiltrate data even when errors are suppressed, so the underlying code flaw remains completely unaddressed.

  When this WOULD be correct

  This would be correct in a question asking for the best mitigation to prevent information disclosure via database error messages, such as in a scenario where the primary concern is leaking schema details through verbose errors.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”