A web application allows SQL injection attacks on its admin panel. What should you recommend to mitigate this issue?

Question

Options

• ARestrict admin access to trusted IPs only
• BIncrease session timeout durations
• CUse HTTP instead of HTTPS for the admin panel
• DHardcode admin passwords

• A
  84% (32)
• B
  3% (1)
• C
  3% (1)
• D
  11% (4)

Explanation

Restricting admin access to trusted IPs reduces the attack surface by ensuring only authorized networks can even reach the vulnerable endpoint, making it the most defensible option among the four choices - though in practice, SQL injection should also be fixed at the code level using parameterized queries.

Why the distractors are wrong:

• B (Increase session timeout): Longer sessions make things worse by giving attackers more time to exploit an active session - it has no effect on SQL injection itself.
• C (Use HTTP instead of HTTPS): Downgrading to HTTP removes encryption, exposing credentials and session tokens to interception - the opposite of a security improvement.
• D (Hardcode admin passwords): Hardcoded credentials are a critical vulnerability on their own; they can't be rotated and are often exposed in source code.

Memory tip: Think of the options as a security spectrum - A limits who can attack, while B/C/D either do nothing or actively worsen security. On exam questions like this, when a true fix (parameterized queries) isn't listed, look for the option that reduces exposure, not one that obscures the problem.

No community discussion yet for this question.