CompTIA CySA+ (CS0-001) — Question 260

Following a data compromise, a cybersecurity analyst noticed the following executed query:
SELECT * from Users WHERE name = rick OR 1=1
Which of the following attacks occurred, and which of the following technical security controls would BEST reduce the risk of future impact from this attack?
(Choose two.)

Answer options

• A. Cookie encryption
• B. XSS attack
• C. Parameter validation
• D. Character blacklist
• E. Malicious code execution
• F. SQL injection

Correct answer: C, F

Explanation

The executed query indicates that an SQL injection attack occurred, as it manipulates the SQL statement to return all users instead of filtering for 'rick'. To mitigate such risks, implementing parameter validation can ensure that user input is properly sanitized, preventing unauthorized SQL commands from being executed.