SY0-701 Question 86
Single answerWeb-based: Structured Query Language injection (SQLi) , Cross-site scripting (XSS)A company launches a customer support portal that allows users to search tickets and post comments. During testing, a security analyst finds two issues: entering ' OR '1'='1 in the ticket search field returns all records, and posting ) in a comment causes other users' browsers to send their session cookies to an external site when the comment is viewed. The development team asks which remediation would MOST directly address both findings in the application code.
- A
Use parameterized queries for database access and implement output encoding/input sanitization appropriate to the rendering context
- B
Enable full-disk encryption on the web server and require VPN access for all remote users
- C
Disable JavaScript in client browsers through group policy and place the database behind a network firewall
- D
Hash session cookies before storing them in the browser and use RAID on the database server
Show answer and explanation
Correct answer: A
Explanation
This scenario contains two distinct web application flaws: SQL injection in the search feature and stored XSS in the comments feature. For SQL injection, best practice is to use parameterized queries/prepared statements so user input is treated strictly as data rather than executable SQL. For XSS, best practice is context-specific output encoding so untrusted input is not interpreted as active HTML/JavaScript when rendered in the browser. Additional secure design measures may include server-side input validation, use of templating frameworks that auto-escape output, Content Security Policy (CSP), and secure cookie attributes such as HttpOnly and Secure to reduce impact. These recommendations align with common guidance from OWASP, including the SQL Injection Prevention Cheat Sheet and Cross Site Scripting Prevention Cheat Sheet.
- A. Correct.
Correct. The first issue is a classic SQL injection condition caused by unsafe construction of SQL statements from user input. Parameterized queries (prepared statements) separate code from data and are a primary defense against SQLi. The second issue is stored cross-site scripting (XSS), where malicious script is saved by the application and executed in other users' browsers. Context-aware output encoding is a primary defense for XSS, and input validation/sanitization can provide additional protection depending on the use case. Together, these controls most directly address the vulnerable coding patterns described.
- B. Incorrect.
Incorrect. Full-disk encryption protects data at rest if storage media are lost or stolen, and VPNs can restrict remote access, but neither control fixes the application's unsafe SQL handling or the browser-side execution of untrusted script. These are secure coding issues, not storage or remote-access issues.
- C. Incorrect.
Incorrect. Disabling JavaScript in browsers would reduce XSS impact in a narrow sense, but it is not a practical or reliable remediation for a public-facing support portal and does not address the root cause in the application. Placing the database behind a firewall is standard architecture hygiene, but SQL injection can still occur through the application if it sends maliciously altered queries to the database.
- D. Incorrect.
Incorrect. Session cookies are not protected by hashing them in the browser; instead, they should be marked with attributes such as HttpOnly, Secure, and SameSite as appropriate. Even then, those measures do not remediate the underlying stored XSS vulnerability in the page output. RAID provides availability and fault tolerance, not protection against SQL injection or XSS.