CISSP Practice Question: A software development team is implementing secure coding practices to prevent common…

Correct Answer: B. Use prepared statements with parameterized queries.

Explanation (CISSP Manager Logic):

Parameterized queries address the root cause of SQL injection by strictly separating executable code from user-supplied data. This "secure by design" approach provides a proactive, scalable control that is more reliable than reactive filtering or perimeter defenses.

By using prepared statements, you:

• Eliminate the risk of malicious command execution at the source.
• Standardize secure coding patterns across the development lifecycle.
• Reduce technical debt by avoiding the maintenance of complex blacklists.

While the other options are relevant, they fall short because:

• A: Input validation is a secondary defense that can often be bypassed by sophisticated encoding or obfuscation.
• C: Encryption protects data confidentiality but does not prevent the database engine from executing a malicious query.
• D: A WAF is a perimeter control that provides defense-in-depth but fails to remediate the underlying code vulnerability.

Think like a manager:

Prioritize architectural solutions that remediate vulnerabilities at their source rather than relying on external layers or easily bypassed filters.