mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A security analyst is reviewing logs from a web…
A security analyst is reviewing logs from a web application firewall (WAF) and notices multiple requests containing the payload "1=1--" in the query string. The analyst suspects a SQL injection attack. Which of the following is the BEST immediate action to validate the suspicion?
⚠ Common exam trap
A common mix-up: candidates choose an active testing tool (Option A) or a remediation step (Option B) instead of recognizing that passive log review is the safest and most immediate validation method in a security assessment context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the application logs for database error messages.
Checking the application logs for database error messages is the best immediate action because SQL injection attempts often trigger verbose database errors (e.g., MySQL syntax errors, ODBC error codes) that confirm the injection point. This passive validation requires no additional tools and directly correlates the WAF alert with backend behavior, avoiding the risk of actively exploiting a live system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a manual SQL injection tool like sqlmap to test the application.
Why it's wrong here
While tools like sqlmap are highly effective for identifying and exploiting SQL injection vulnerabilities, actively testing an application, especially in a production environment or without explicit authorization, can be highly intrusive and potentially destructive. Such actions could lead to data corruption, denial of service, or legal repercussions, making it an inappropriate initial step for merely validating a potential injection based on existing log observations. This approach shifts from passive observation to active, potentially harmful exploitation.
- ✗
Implement prepared statements in the application code.
Why it's wrong here
Implementing prepared statements is a robust and essential security control designed to prevent SQL injection vulnerabilities by ensuring that user-supplied data is treated as data, not executable code. However, this action constitutes a code change and a permanent remediation measure, not an immediate diagnostic step to validate whether a suspected SQL injection has already occurred or is currently exploitable based on existing log data. The question implies a need for immediate validation, not a long-term architectural fix.
- ✗
Run a vulnerability scan with a SQL injection detection module.
Why it's wrong here
Running a full vulnerability scan, even one equipped with a specific SQL injection detection module, is typically a time-consuming and resource-intensive process that involves actively probing the application for various weaknesses. While valuable for comprehensive security assessments and identifying a broad range of vulnerabilities, it is not an immediate or targeted method for validating a specific suspected SQL injection event indicated by log entries. The analyst needs a quicker, more direct confirmation based on the observed logs, rather than initiating a broad, potentially lengthy scan.
- ✓
Check the application logs for database error messages.
Why this is correct
Reviewing application logs for database error messages is the most immediate, passive, and non-intrusive method to validate a suspected SQL injection. Successful SQL injection attempts, especially those designed to extract information or manipulate queries, often result in distinct database errors (e.g., syntax errors, unhandled exceptions, or specific database-level warnings) that are logged by the application or database server. These errors provide direct, forensic evidence of an attempted or successful injection, allowing the analyst to confirm the vulnerability without active probing or risk to the system.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.