Question 695 of 1,152

Threats, Vulnerabilities, and Mitigations →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct answer is to rewrite the database access layer to use parameterized queries or prepared statements. This fix is essential because SQL injection prevention relies on separating SQL logic from user input; parameterized queries ensure that user-supplied data is treated strictly as data, not as executable code, which blocks attacks like the `UNION SELECT` injection that caused database error messages. On the Security+ SY0-701 exam, this scenario tests your understanding of secure coding practices under Domain 3 (Implementation), specifically how to remediate injection flaws—a common trap is choosing input validation or escaping alone, which are less reliable than parameterization. Remember the memory tip: "Parameters protect, concatenation corrupts"—if you see user input directly concatenated into a SQL string, the fix is always prepared statements.

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

This SY0-701 practice question tests your understanding of threats, vulnerabilities, and mitigations. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

After a new search feature goes live, logs show requests containing `UNION SELECT` and the application returns database error messages. Security testing confirms attackers can retrieve rows from other tables by modifying the query string. Which fix is best?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

Question 1mediummultiple choice

Full question →

A
Rewrite the database access layer to use parameterized queries or prepared statements.
Parameterized queries separate user input from SQL code, which prevents attacker-controlled strings from changing the query structure. That directly addresses the injection flaw rather than only hiding symptoms. Because the app is already returning database errors and leaking data, the safest fix is to eliminate dynamic SQL construction at the source of the problem.
B
Encode special characters in the browser before submitting the search form.
Why wrong: Client-side encoding can be bypassed and does not protect the server if unsafe query construction still exists.
C
Disable detailed error messages so attackers cannot see the database name.
Why wrong: Hiding errors reduces information leakage, but it does not stop SQL injection or unauthorized data access.
D
Increase password complexity requirements for all application users.
Why wrong: Stronger passwords help account security, but they do not correct the input validation and query construction failure.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Rewrite the database access layer to use parameterized queries or prepared statements.

The attack described is SQL injection, where the attacker uses `UNION SELECT` to extract data from other tables. The most effective and industry-standard fix is to use parameterized queries or prepared statements, which separate SQL logic from user input, preventing the database from interpreting malicious input as executable code. This directly addresses the root cause by ensuring user-supplied data is treated as data, not as part of the SQL command.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Rewrite the database access layer to use parameterized queries or prepared statements.
Why this is correct
Parameterized queries separate user input from SQL code, which prevents attacker-controlled strings from changing the query structure. That directly addresses the injection flaw rather than only hiding symptoms. Because the app is already returning database errors and leaking data, the safest fix is to eliminate dynamic SQL construction at the source of the problem.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Encode special characters in the browser before submitting the search form.
Why it's wrong here
Client-side encoding can be bypassed and does not protect the server if unsafe query construction still exists.
✗
Disable detailed error messages so attackers cannot see the database name.
Why it's wrong here
Hiding errors reduces information leakage, but it does not stop SQL injection or unauthorized data access.
✗
Increase password complexity requirements for all application users.
Why it's wrong here
Stronger passwords help account security, but they do not correct the input validation and query construction failure.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often choose to hide error messages (Option C) thinking it stops the attack, but this only obscures the information leakage without fixing the underlying SQL injection flaw, which can still be exploited via blind techniques.

Detailed technical explanation

How to think about this question

Parameterized queries work by pre-compiling the SQL statement with placeholders (e.g., `?` in MySQLi or `:param` in PDO), then binding user input to those placeholders. This ensures the database engine treats the input strictly as a literal value, not as executable SQL syntax, even if it contains malicious keywords like `UNION`. In contrast, simple escaping functions (e.g., `mysql_real_escape_string`) can be bypassed if the application uses multibyte character sets or certain database configurations, making parameterization the only reliable defense.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related SY0-701 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

General Security Concepts practice questions

Practise SY0-701 questions linked to General Security Concepts.

Threats, Vulnerabilities, and Mitigations practice questions

Practise SY0-701 questions linked to Threats, Vulnerabilities, and Mitigations.

Security Architecture practice questions

Practise SY0-701 questions linked to Security Architecture.

Security Operations practice questions

Practise SY0-701 questions linked to Security Operations.

Security Program Management and Oversight practice questions

Practise SY0-701 questions linked to Security Program Management and Oversight.

Security+ social engineering questions

Practise SY0-701 questions linked to Security+ social engineering questions.

Security+ cryptography practice questions

Practise SY0-701 questions linked to Security+ cryptography.

Security+ IAM questions

Practise SY0-701 questions linked to Security+ IAM questions.

Security+ risk management questions

Practise SY0-701 questions linked to Security+ risk management questions.

Security+ incident response questions

Practise SY0-701 questions linked to Security+ incident response questions.

Security+ malware questions

Practise SY0-701 questions linked to Security+ malware questions.

Security+ vulnerability management questions

Practise SY0-701 questions linked to Security+ vulnerability management questions.

Practice this exam

Start a free SY0-701 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SY0-701 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SY0-701 question test?

Threats, Vulnerabilities, and Mitigations — This question tests Threats, Vulnerabilities, and Mitigations — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Rewrite the database access layer to use parameterized queries or prepared statements. — The attack described is SQL injection, where the attacker uses `UNION SELECT` to extract data from other tables. The most effective and industry-standard fix is to use parameterized queries or prepared statements, which separate SQL logic from user input, preventing the database from interpreting malicious input as executable code. This directly addresses the root cause by ensuring user-supplied data is treated as data, not as part of the SQL command.

What should I do if I get this SY0-701 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on SY0-701

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Which four of the following are effective mitigations against SQL injection attacks? (Choose four.)

medium

✓ .Using parameterized queries or prepared statements
✓ .Implementing input validation and sanitization
✓ .Enforcing least privilege for database accounts
✓ .Disabling error messages that reveal database structure
.Blocking all user input containing the word 'SELECT'
.Using client-side JavaScript validation exclusively

Why : Parameterized queries and prepared statements are effective because they separate SQL logic from user input, ensuring that input is treated as data rather than executable code. This prevents attackers from injecting malicious SQL commands into query strings, as the database engine compiles the query structure before parameters are bound.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.