SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A support portal searches customers by last name using a parameter called q. After one user enters a single quote, the app returns a SQL syntax error. A tester then submits `test' OR '1'='1` and sees every customer record. Which control most directly prevents this issue?
⚠ Common exam trap
Candidates often confuse output encoding (XSS prevention) with input handling (SQL injection prevention), or they think network controls like VLANs can fix application-layer code flaws.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Parameterize the database queries with prepared statements
The vulnerability is SQL injection, which occurs when user input is directly concatenated into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data by using placeholders, ensuring user input is treated as data only and never executed as code. This directly prevents the attacker from injecting malicious SQL fragments like `' OR '1'='1`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Parameterize the database queries with prepared statements
Why this is correct
Prepared statements parameterize user input so the database engine compiles the SQL query structure once, before any data is bound. The search term is passed as a pure string parameter, never concatenated into the SQL text, so malicious input like ' OR 1=1 -- cannot alter the query's WHERE clause semantics. This eliminates the injection payload's ability to change the query's logical structure.
- ✗
Encode all output returned to the browser
Why it's wrong here
Output encoding neutralizes browser-side injection like cross-site scripting by converting special characters to their HTML entities before rendering, but it operates after the server has already processed the request. SQL injection happens during database query construction on the server, far upstream of the response's output stream; encoding the returned data does nothing to stop the attacker's crafted input from being interpreted as SQL syntax.
- ✗
Add CSRF tokens to the login form
Why it's wrong here
CSRF tokens validate that a request originated from the authenticated user's session by requiring a random, per-session value, but they do not inspect the content of submitted parameters. SQL injection is an input-validation flaw where the attacker's search string is executed by the database; the token only proves the request's origin, not that the payload is safe, so the injected SQL would still run.
- ✗
Move the application to a separate VLAN
Why it's wrong here
Moving the application to a separate VLAN limits the network blast radius if a server is compromised by isolating it from other systems, but it does not alter the application's SQL query construction. The vulnerable search endpoint remains fully reachable over the network, and an attacker can still submit malicious last-name values that get concatenated into the SQL statement; segmenting the network only reduces post-exploitation lateral movement, not the injection vulnerability itself.
Visual reference
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.