SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
During testing, a login form returns all user records when the tester enters ' OR '1'='1 in a username field. What is the best fix for this issue?
⚠ Common exam trap
Candidates often choose hiding error messages (Option A) because they confuse symptom masking with root-cause remediation, but the exam tests the principle that input validation and parameterized queries are the only reliable fix for SQL injection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use parameterized queries or prepared statements
The SQL injection attack ' OR '1'='1 bypasses authentication by always evaluating to true, returning all user records. Parameterized queries (prepared statements) separate SQL logic from user input, preventing the injected string from altering the query structure. This is the industry-standard mitigation for SQL injection vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hide database error messages from the login page only
Why it's wrong here
Simply hiding database error messages from the login page suppresses a symptom but leaves the SQL injection flaw intact. With error-based details masked, an attacker can still use blind SQL injection techniques that infer results via timing or boolean conditions, reading all user records without any visible error. Moreover, limiting the change to the login page ignores other endpoints that may share the same vulnerable query construction, so the database remains exposed.
- ✓
Use parameterized queries or prepared statements
Why this is correct
Parameterized queries (prepared statements) separate an SQL statement’s structure from its data by sending a query template with placeholders to the database engine before binding input as values. Because the database compiles the template once and treats every subsequent input strictly as a literal value, a payload such as ' OR '1'='1 is treated as a string, not as SQL syntax, rendering the injection attempt ineffective. This defense neutralizes the root cause of the vulnerability: unsanitized string concatenation in the query builder.
- ✗
Require users to change passwords more often
Why it's wrong here
Forcing users to change passwords more often is a credential lifecycle control that does nothing to alter how the login form constructs its SQL statement. The vulnerable query still concatenates user-supplied input directly into the command text, so even a brand-new, highly complex password containing characters like ' or -- will be interpreted as code rather than data. Password rotation frequency is unrelated to input validation, query parameterization, or privilege separation, leaving the injection fully exploitable.
- ✗
Move the login page to a different URL
Why it's wrong here
Moving the login page to a different URL only relocates a vulnerable application component without modifying the back-end code that builds the SQL query. An attacker who discovers the new endpoint—whether through automated scanning, bookmarks, or site documentation—can replay the same malicious payload and trigger identical behavior, such as retrieving all user records. This is a classic "security through obscurity" approach that provides no protection against direct parameter manipulation or fuzzing of input fields.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Standard
A standard is an agreed-upon set of rules, guidelines, or specifications that ensure consistency, compatibility, and quality across IT products, services, and processes.
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.