easyMultiple ChoiceObjective-mapped
CISSP Practice Question: During a code review, a developer notices that an…
During a code review, a developer notices that an application directly concatenates user input into SQL queries. Which type of vulnerability does this represent?
⚠ Common exam trap
It's easy for candidates to confuse SQL injection with cross-site scripting (XSS) because both involve injection of untrusted data, but XSS targets the browser's DOM, not the database query layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection
Directly concatenating user input into SQL queries allows an attacker to inject arbitrary SQL commands, altering the query's intended behavior. This is the classic definition of SQL injection, which can lead to unauthorized data access, modification, or deletion. The vulnerability arises because the input is treated as executable code rather than data, bypassing parameterized query protections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting (XSS) involves injecting malicious client-side scripts, typically JavaScript, into web pages viewed by other users. This vulnerability exploits the browser's trust in a website, allowing an attacker to execute arbitrary code within the victim's browser context. While dangerous, XSS primarily targets the client-side and user's browser, rather than directly manipulating server-side SQL database queries.
- ✗
Cross-site request forgery (CSRF)
Why it's wrong here
Cross-site request forgery (CSRF) tricks an authenticated user's browser into sending an unintended request to a web application where they are currently logged in. This attack leverages the trust a web application has in a user's browser, often by exploiting session cookies. CSRF does not involve direct manipulation of SQL query input but rather forces the victim's browser to perform actions on their behalf.
- ✗
Buffer overflow
Why it's wrong here
A buffer overflow occurs when a program attempts to write data beyond the boundaries of a fixed-size buffer in memory. This can overwrite adjacent memory locations, potentially corrupting data, crashing the program, or even executing arbitrary code by altering control flow. While a critical memory safety issue, it is a low-level programming error unrelated to the logical structure modification of SQL queries.
- ✓
SQL injection
Why this is correct
SQL injection is a code injection technique that exploits vulnerabilities in an application's database layer, specifically when user-supplied input is directly concatenated into SQL queries without proper sanitization or parameterization. This allows an attacker to modify the intended SQL query structure, enabling unauthorized data access, modification, deletion, or even execution of administrative commands on the database server. It directly targets the database query logic.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.