CISSP Software Development Security Practice Question
A security team is reviewing a web application that allows users to search for products. The application uses a SQL database and constructs queries by concatenating user input directly into the SQL statement. Which of the following is the most effective mitigation against SQL injection attacks?
⚠ Common exam trap
It's easy for candidates to choose input validation or escaping because they seem proactive, but the CISSP exam emphasizes that parameterized queries are the only definitive defense against SQL injection at the code level, as they enforce separation of code and data by design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using parameterized queries with prepared statements
Parameterized queries with prepared statements separate SQL logic from user input by sending the query structure to the database first, then binding input values as data parameters. This prevents the database from interpreting user input as executable SQL code, even if the input contains malicious characters. It is the only defense that completely eliminates the injection vector at the database interaction layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Using parameterized queries with prepared statements
Why this is correct
Parameterized queries with prepared statements are the most effective defense against SQL injection because they fundamentally separate the SQL code structure from user-provided data. The database engine treats all input as literal values, not executable commands, preventing malicious input from altering the query's intent. This architectural separation ensures that special characters in user input are never interpreted as SQL syntax, thereby eliminating the injection vector at its root.
- ✗
Escaping all user input before concatenation
Why it's wrong here
Escaping all user input before concatenation is an unreliable defense against SQL injection due to its inherent complexity and potential for errors. Developers must correctly identify and escape all context-specific special characters, which is difficult to do exhaustively across various database systems and encoding schemes. A single missed character or incorrect escaping rule can create a vulnerability, making it a brittle and high-maintenance approach that is prone to bypasses.
- ✗
Input validation using a blacklist of known malicious patterns
Why it's wrong here
Input validation using a blacklist of known malicious patterns is fundamentally flawed because it operates on an incomplete and reactive basis. Attackers can often bypass blacklists by employing novel attack techniques, using different encodings, or discovering patterns not included in the list. This approach creates a false sense of security and requires constant, exhaustive updates to remain even marginally effective, which is practically unsustainable.
- ✗
Implementing a Web Application Firewall (WAF)
Why it's wrong here
Implementing a Web Application Firewall (WAF) acts as a valuable compensating control, but it does not comprehensively prevent application-layer vulnerabilities like SQL injection at the source. While a WAF can detect and block many common attack signatures, it operates at the network perimeter and cannot fix insecure application code. It may be bypassed by sophisticated attackers, generate false positives, or miss zero-day exploits, making it a secondary defense rather than a primary solution for secure coding practices.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.