mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A security analyst runs a vulnerability scan and…
Exhibit
Refer to the exhibit. Vulnerability Scan Report Excerpt: [+] SQL Injection (SQLi) - Parameter 'id' URL: https://app.example.com/item?id=123 Payload: 1' OR '1'='1 Risk: Critical CVE: CVE-2023-XXXX [+] Stored XSS - Parameter 'name' URL: https://app.example.com/profile Payload: <script>alert(1)</script> Risk: High [+] Open Redirect - Parameter 'next' URL: https://app.example.com/login?next= Payload: https://evil.com Risk: Medium
A security analyst runs a vulnerability scan and sees the output shown in the exhibit. The analyst wants to remediate the most critical issue first. Which action should the analyst take to address the SQL injection vulnerability?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rewrite the database query to use parameterized statements.
The correct action to remediate SQL injection is to use parameterized statements (prepared statements), which separate SQL code from data and prevent injection entirely. Option A (WAF) is a compensating control but does not fix the root cause. Option C (input validation) can be bypassed and is not a definitive solution. Option D (output encoding) addresses XSS, not SQL injection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a web application firewall (WAF) with SQL injection signatures.
Why it's wrong here
Deploying a web application firewall (WAF) with SQL injection signatures acts as a compensating control, providing an additional layer of defense by inspecting and filtering HTTP traffic for known attack patterns. While a WAF can detect and block many common SQL injection attempts, it does not remediate the underlying insecure code in the application. Sophisticated attackers can often craft polymorphic payloads to evade WAF signatures, making it a secondary defense rather than a primary fix for the root cause.
- ✓
Rewrite the database query to use parameterized statements.
Why this is correct
Rewriting the database query to use parameterized statements is the definitive solution for preventing SQL injection. This technique ensures that user-supplied input is treated purely as data values, not as executable SQL code. The query structure is pre-compiled by the database, and then the user input is bound to placeholders, preventing an attacker from altering the query's logic or introducing new commands, thereby maintaining the strict separation of code and data.
- ✗
Implement strict input validation on the 'id' parameter.
Why it's wrong here
Implementing strict input validation on the 'id' parameter attempts to sanitize or reject malicious input, but it is not a foolproof defense against SQL injection. Attackers can often craft sophisticated payloads that bypass even stringent validation rules, especially with various encoding schemes or edge cases. While good for data integrity, input validation is a reactive measure that doesn't address the fundamental vulnerability of concatenating user input directly into SQL queries.
- ✗
Encode all output from the 'id' parameter using HTML entity encoding.
Why it's wrong here
Encoding all output from the 'id' parameter using HTML entity encoding is a crucial security measure, but it specifically prevents Cross-Site Scripting (XSS) attacks, not SQL injection. HTML entity encoding transforms characters like '<' and '>' into their HTML entity equivalents, preventing a web browser from interpreting them as executable HTML or script tags. This process has no effect on how a database server interprets SQL commands, thus offering no protection against malicious SQL syntax injected into a query.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Compensating control
A compensating control is a security measure implemented to reduce risk when a primary control cannot be used or is insufficient.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.