SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
After a new search feature goes live, logs show requests containing `UNION SELECT` and the application returns database error messages. Security testing confirms attackers can retrieve rows from other tables by modifying the query string. Which fix is best?
⚠ Common exam trap
A common mix-up: candidates choose to hide error messages (Option C) thinking it stops the attack, but this only obscures the information leakage without fixing the underlying SQL injection flaw, which can still be exploited via blind techniques.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rewrite the database access layer to use parameterized queries or prepared statements.
The attack described is SQL injection, where the attacker uses `UNION SELECT` to extract data from other tables. The most effective and industry-standard fix is to use parameterized queries or prepared statements, which separate SQL logic from user input, preventing the database from interpreting malicious input as executable code. This directly addresses the root cause by ensuring user-supplied data is treated as data, not as part of the SQL command.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Rewrite the database access layer to use parameterized queries or prepared statements.
Why this is correct
Parameterized queries separate user input from SQL code, which prevents attacker-controlled strings from changing the query structure. That directly addresses the injection flaw rather than only hiding symptoms. Because the app is already returning database errors and leaking data, the safest fix is to eliminate dynamic SQL construction at the source of the problem.
- ✗
Encode special characters in the browser before submitting the search form.
Why it's wrong here
Encoding special characters in the browser is a client-side control that only alters what the web form sends; an attacker can bypass it entirely by submitting crafted requests directly to the server with tools like curl. Even if the browser encodes input, the server-side code still concatenates that input into raw SQL, so the injection vulnerability remains fully exploitable. This approach also risks corrupting legitimate search strings that contain apostrophes or percent signs, and it never addresses the root cause: unsafe query construction.
- ✗
Disable detailed error messages so attackers cannot see the database name.
Why it's wrong here
Disabling detailed error messages limits information disclosure by hiding database names and stack traces, but SQL injection does not require verbose errors to succeed. An attacker can use blind techniques—like observing boolean true/false differences, response delays, or out-of-band DNS callbacks—to infer data one bit at a time. The underlying query is still built with unsanitized input, so the vulnerability and unauthorized data access continue.
- ✗
Increase password complexity requirements for all application users.
Why it's wrong here
Improving password complexity strengthens authentication and makes credential guessing harder, but the search feature's SQL injection is an authorization and input-handling flaw, not a password problem. An unauthenticated or low-privileged attacker can exploit the injection to read sensitive data directly from the database without ever presenting valid credentials. This change does not modify how SQL statements are assembled and therefore has zero effect on the injection vulnerability.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Standard
A standard is an agreed-upon set of rules, guidelines, or specifications that ensure consistency, compatibility, and quality across IT products, services, and processes.
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which four of the following are effective mitigations against SQL injection attacks? (Choose four.)
medium- ✓ .Using parameterized queries or prepared statements
- ✓ .Enforcing least privilege for database accounts
- ✓ .Disabling error messages that reveal database structure
- .Blocking all user input containing the word 'SELECT'
- .Using client-side JavaScript validation exclusively
- ✓ .Implementing input validation and sanitization
Why : Parameterized queries and prepared statements are effective because they separate SQL logic from user input, ensuring that input is treated as data rather than executable code. This prevents attackers from injecting malicious SQL commands into query strings, as the database engine compiles the query structure before parameters are bound.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.