FirstTry
Objective 2.4CS0-003

2.4 Given a scenario, recommend controls to mitigate attacks and software vulnerabilities.

Objective 2.4 sits in Vulnerability Management, which carries 30% of the CySA+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-4Vulnerability ManagementModerate

A code reviewer on your team asks which coding pattern makes an application injectable through its database queries. What is the root condition?

Storing hashed passwords in the databasePassword storage choices are unrelated to query construction.
Dynamic queries concatenating user inputCorrect · your answerCorrect: string-concatenated dynamic queries with user input are the injectable pattern.
Using an object-relational mapperORMs can still be misused, but they are not the root condition named.
Running the database on the same hostHost placement changes blast radius, not injectability.

Correct.

Concept

Injection happens where untrusted text is glued into an executable statement. The vulnerable ingredient is the construction pattern, not the database engine or its location.

Why B

The cheat sheet states attackers can use SQL injection when an application has dynamic database queries that use string concatenation and user-supplied input; removing that pattern removes the flaw.

Source

#sql-injection#secure-coding#mitigation

Now you: objective 2.4 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-4Vulnerability ManagementModerate

An analyst must recommend the primary control for SQL injection findings across many apps. Which one leads the list?

Sample question 2 of 3

2-4Vulnerability ManagementHard

A finding cites this code:

String query = "SELECT account_balance FROM user_data WHERE user_name = "
  + request.getParameter("customerName");

What remediation do you recommend?

Sample question 3 of 3

2-4Vulnerability ManagementModerate

A legacy team proposes escaping every user input as their whole SQL injection defense. How does the guidance rate that option?

Full CySA+ question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Vulnerability Management