mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A company deploys a web application that…
A company deploys a web application that processes credit card payments. The development team uses parameterized queries for all database interactions. However, during a penetration test, the tester successfully injects malicious code into a search field and retrieves sensitive customer data. Which of the following is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application uses dynamic SQL despite parameterized queries for some fields.
The use of parameterized queries prevents SQL injection, but if dynamic SQL is constructed elsewhere in the application (e.g., for the search field), it can still be vulnerable. Option B is incorrect because directory traversal exploits file system access, not database query injection. Option C is incorrect because direct query execution would require explicit permissions beyond the application's context. Option D is incorrect because XSS affects client-side execution, not direct data retrieval from the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The application uses dynamic SQL despite parameterized queries for some fields.
Why this is correct
Dynamic SQL in the search field bypasses the parameterized queries used elsewhere, allowing injection.
- ✗
The web server is misconfigured to allow directory traversal.
Why it's wrong here
Directory traversal allows reading files from the server's file system, not injecting malicious code into database queries. It does not explain how the tester retrieved sensitive customer data via injection.
- ✗
The database server has weak permissions allowing direct query execution.
Why it's wrong here
Weak permissions could allow unauthorized queries, but the injection occurred through the application.
- ✗
The search field output is not sanitized, allowing stored XSS.
Why it's wrong here
Stored XSS is a client-side attack that injects malicious scripts into web pages viewed by other users. It does not directly enable retrieval of sensitive customer data from the database.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.