CND Application And Data Protection Practice Question
An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use parameterized queries and PreparedStatement objects with placeholder parameters
Using parameterized queries (PreparedStatements) ensures that user-supplied input is treated strictly as data, never as executable SQL commands, neutralizing SQL injection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Invoke the java.net.URLEncoder.encode() method on all parameters
Why it's wrong here
URLEncoder is designed for HTTP request parameters, not for protecting against SQL injection.
- ✗
Wrap all input strings inside single quotes and strip out semicolon characters
Why it's wrong here
Manual quote wrapping and character stripping are prone to bypasses and are not a secure defense against SQL injection.
- ✓
Use parameterized queries and PreparedStatement objects with placeholder parameters
Why this is correct
Parameterized queries separate query structure from user data, safely neutralizing SQL injection attacks.
- ✗
Sanitize all input characters using HTML entity encoding before passing them to the database driver
Why it's wrong here
HTML entity encoding prevents Cross-Site Scripting (XSS), not SQL injection.
About these practice questions
This CND question is part of Courseiva's 323-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.