ISC2 CISSP Practice Question

The correct answer is Using stored procedures with parameterized queries. Stored procedures with parameterized queries provide the most comprehensive protection against SQL injection because they ensure that user input is always treated as data rather than executable code. This approach handles the separation of code and data at the database level, providing strong protection regardless of how the application constructs its queries. The database engine treats the parameters as literal values rather than executable SQL, preventing injection attacks even with malicious input.

Implementing proper error handling is incorrect because while proper error handling is important for preventing information leakage that could assist attackers, it doesn't prevent SQL injection attacks. Error handling is about managing the aftermath of errors rather than preventing the injection vulnerability itself.

Encrypting database connections is incorrect because encrypting database connections protects data in transit between the application and database but doesn't prevent SQL injection. Connection encryption addresses confidentiality of the communication channel but not how queries are constructed or executed.

Regular database backups is incorrect because regular backups are important for recovery after a security incident but don't prevent SQL injection attacks from occurring. Backups are a detective and corrective control rather than a preventive control for SQL injection.