GIAC Foundational Cybersecurity Technologies Practice Test

What is a recommended way to mitigate SQL injection attacks?

1. Use a secure framework for application development

2. Encrypt all database queries

3. Avoid insecure methods of passing queries to the database

4. Implement network-level firewalls

The correct answer is: Avoid insecure methods of passing queries to the database

Mitigating SQL injection attacks requires careful attention to how database queries are constructed and executed. Using parameterized queries or prepared statements is a vital strategy; these techniques prevent attackers from injecting malicious SQL code because user input is treated as data rather than executable code. While securing the method of passing queries is crucial, employing secure frameworks for application development also significantly reduces the risk, as these frameworks often come with built-in defenses against SQL injection. Thus, while avoiding insecure methods greatly enhances safety, leveraging secure frameworks can provide multi-layered protection. Encrypting database queries may protect data in transit but does not address the fundamental issue of SQL injection, as the way queries are structured remains vulnerable if not properly handled. Implementing network-level firewalls helps in controlling access to the database but does not inherently protect against SQL injection vulnerabilities within the application itself. Overall, focusing on how queries are constructed and ensuring safe practices when handling user input is the most direct and effective method to mitigate SQL injection attacks.