Ethical Hacking Essentials Practice Test

Which countermeasure helps secure a database against SQL injection attacks?

1. Avoid constructing dynamic SQL with concatenated input values

2. Use static SQL queries

3. Implement user authentication

4. Encrypt all database fields

The correct answer is: Avoid constructing dynamic SQL with concatenated input values

The recommended countermeasure to secure a database against SQL injection attacks is to avoid constructing dynamic SQL with concatenated input values. SQL injection occurs when an attacker is able to manipulate a SQL query by injecting malicious input, which can happen particularly when user inputs are concatenated directly into SQL statements. By avoiding dynamic SQL, which often involves directly embedding user input within a query string, the risk of injection is mitigated. In contrast, using static SQL queries may enhance security, but it is not a standalone solution. Static queries can still be vulnerable if not implemented correctly. While implementing user authentication adds an important layer of security to protect access to the database, it does not directly prevent SQL injection vulnerabilities from occurring. Similarly, encrypting all database fields is related to data security but does not address the primary vector through which SQL injection attacks occur, which is the construction of the SQL query itself. Hence, focusing on the construction of SQL queries is pivotal in protecting against SQL injection attacks.