Computer Security Applicationsintermediate
Select ALL safeguards from the lesson that can help reduce Structured Query Language (SQL) injection risk.
Answer
Use parameterized queries, Validate and sanitize user input, Give the application database account only required permissions, Monitor logs for suspicious activity
Explanation
### Why this is right
- **A** is correct: parameterized queries prevent input from being interpreted as query instructions.
- **B** is correct: validation and sanitization restrict input to expected forms, though they should not replace parameterized queries.
- **C** is correct: least privilege limits what an attacker can do if an application account is misused.
- **E** is correct: log monitoring can reveal suspicious behavior for investigation.
### The concept
These safeguards act at different points. Parameterization protects query structure, validation checks input, least privilege limits database authority, and monitoring supports detection. Using all of them gives stronger protection than relying on one measure.
### The other options
- **D. Build database commands dynamically from unchecked input**: this creates the unsafe condition that injection attacks exploit.
### Terms
- **SQL**: Structured Query Language, a language for working with relational databases.
- **Least privilege**: giving an account only the permissions needed for its task.
- **Sanitization**: processing input to remove or neutralize content that is not allowed.
### Remember
Prevent, limit, and detect: use safeguards that address different stages of risk.
Related Questions
- A database-backed application needs to stop showing detailed database errors to ordinary users while retaining information for investigation. Which approach best matches the lesson?(intermediate)
- Regular security audits and penetration tests can help identify and fix application weaknesses before attackers exploit them.(basic)
- A Web Application Firewall (WAF) should be treated as a replacement for secure query construction.(basic)
- A database account should have only the permissions required for its task. This is the principle of _____.(basic)
- In blind Structured Query Language (SQL) injection, the attacker cannot directly see the result and instead infers information from application behavior.(basic)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free