- A
Rewrite the database access layer to use parameterized queries or prepared statements.
Parameterized queries separate user input from SQL code, which prevents attacker-controlled strings from changing the query structure. That directly addresses the injection flaw rather than only hiding symptoms. Because the app is already returning database errors and leaking data, the safest fix is to eliminate dynamic SQL construction at the source of the problem.
- B
Encode special characters in the browser before submitting the search form.
Why wrong: Client-side encoding can be bypassed and does not protect the server if unsafe query construction still exists.
- C
Disable detailed error messages so attackers cannot see the database name.
Why wrong: Hiding errors reduces information leakage, but it does not stop SQL injection or unauthorized data access.
- D
Increase password complexity requirements for all application users.
Why wrong: Stronger passwords help account security, but they do not correct the input validation and query construction failure.
Quick Answer
The correct answer is to rewrite the database access layer to use parameterized queries or prepared statements. This fix is essential because SQL injection prevention relies on separating SQL logic from user input; parameterized queries ensure that user-supplied data is treated strictly as data, not as executable code, which blocks attacks like the `UNION SELECT` injection that caused database error messages. On the Security+ SY0-701 exam, this scenario tests your understanding of secure coding practices under Domain 3 (Implementation), specifically how to remediate injection flaws—a common trap is choosing input validation or escaping alone, which are less reliable than parameterization. Remember the memory tip: "Parameters protect, concatenation corrupts"—if you see user input directly concatenated into a SQL string, the fix is always prepared statements.
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
This SY0-701 practice question tests your understanding of threats, vulnerabilities, and mitigations. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
After a new search feature goes live, logs show requests containing `UNION SELECT` and the application returns database error messages. Security testing confirms attackers can retrieve rows from other tables by modifying the query string. Which fix is best?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"best"Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Rewrite the database access layer to use parameterized queries or prepared statements.
The attack described is SQL injection, where the attacker uses `UNION SELECT` to extract data from other tables. The most effective and industry-standard fix is to use parameterized queries or prepared statements, which separate SQL logic from user input, preventing the database from interpreting malicious input as executable code. This directly addresses the root cause by ensuring user-supplied data is treated as data, not as part of the SQL command.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Rewrite the database access layer to use parameterized queries or prepared statements.
Why this is correct
Parameterized queries separate user input from SQL code, which prevents attacker-controlled strings from changing the query structure. That directly addresses the injection flaw rather than only hiding symptoms. Because the app is already returning database errors and leaking data, the safest fix is to eliminate dynamic SQL construction at the source of the problem.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Encode special characters in the browser before submitting the search form.
Why it's wrong here
Client-side encoding can be bypassed and does not protect the server if unsafe query construction still exists.
- ✗
Disable detailed error messages so attackers cannot see the database name.
Why it's wrong here
Hiding errors reduces information leakage, but it does not stop SQL injection or unauthorized data access.
- ✗
Increase password complexity requirements for all application users.
Why it's wrong here
Stronger passwords help account security, but they do not correct the input validation and query construction failure.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often choose to hide error messages (Option C) thinking it stops the attack, but this only obscures the information leakage without fixing the underlying SQL injection flaw, which can still be exploited via blind techniques.
Detailed technical explanation
How to think about this question
Parameterized queries work by pre-compiling the SQL statement with placeholders (e.g., `?` in MySQLi or `:param` in PDO), then binding user input to those placeholders. This ensures the database engine treats the input strictly as a literal value, not as executable SQL syntax, even if it contains malicious keywords like `UNION`. In contrast, simple escaping functions (e.g., `mysql_real_escape_string`) can be bypassed if the application uses multibyte character sets or certain database configurations, making parameterization the only reliable defense.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Threats, Vulnerabilities, and Mitigations — study guide chapter
Learn the concepts, then practise the questions
- →
Threats, Vulnerabilities, and Mitigations practice questions
Targeted practice on this topic area only
- →
All SY0-701 questions
1,152 questions across all exam domains
- →
Security+ SY0-701 study guide
Full concept coverage aligned to exam objectives
- →
SY0-701 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SY0-701 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
General Security Concepts practice questions
Practise SY0-701 questions linked to General Security Concepts.
Threats, Vulnerabilities, and Mitigations practice questions
Practise SY0-701 questions linked to Threats, Vulnerabilities, and Mitigations.
Security Architecture practice questions
Practise SY0-701 questions linked to Security Architecture.
Security Operations practice questions
Practise SY0-701 questions linked to Security Operations.
Security Program Management and Oversight practice questions
Practise SY0-701 questions linked to Security Program Management and Oversight.
Security+ social engineering questions
Practise SY0-701 questions linked to Security+ social engineering questions.
Security+ cryptography practice questions
Practise SY0-701 questions linked to Security+ cryptography.
Security+ IAM questions
Practise SY0-701 questions linked to Security+ IAM questions.
Security+ risk management questions
Practise SY0-701 questions linked to Security+ risk management questions.
Security+ incident response questions
Practise SY0-701 questions linked to Security+ incident response questions.
Security+ malware questions
Practise SY0-701 questions linked to Security+ malware questions.
Security+ vulnerability management questions
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practice this exam
Start a free SY0-701 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SY0-701 question test?
Threats, Vulnerabilities, and Mitigations — This question tests Threats, Vulnerabilities, and Mitigations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Rewrite the database access layer to use parameterized queries or prepared statements. — The attack described is SQL injection, where the attacker uses `UNION SELECT` to extract data from other tables. The most effective and industry-standard fix is to use parameterized queries or prepared statements, which separate SQL logic from user input, preventing the database from interpreting malicious input as executable code. This directly addresses the root cause by ensuring user-supplied data is treated as data, not as part of the SQL command.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which four of the following are effective mitigations against SQL injection attacks? (Choose four.)
medium- ✓ .Using parameterized queries or prepared statements
- ✓ .Implementing input validation and sanitization
- ✓ .Enforcing least privilege for database accounts
- ✓ .Disabling error messages that reveal database structure
- .Blocking all user input containing the word 'SELECT'
- .Using client-side JavaScript validation exclusively
Why : Parameterized queries and prepared statements are effective because they separate SQL logic from user input, ensuring that input is treated as data rather than executable code. This prevents attackers from injecting malicious SQL commands into query strings, as the database engine compiles the query structure before parameters are bound.
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.