Many IIS servers connect to Microsoft SQL databases. Which of the following statements about SQL server security is TRUE?

Allowing an application to send raw, user-supplied SQL commands directly to a database server is a critical security flaw. This practice is the primary enabler of SQL injection (SQLi) attacks, where an attacker can manipulate the SQL query to bypass authentication, exfiltrate sensitive data, or modify database records. The secure best practice is to use parameterized queries (also known as prepared statements) or strongly-typed stored procedures. These methods ensure that user input is treated strictly as data and not as executable code, thereby neutralizing the threat of SQL injection.

A. SQL Server and the Windows operating system have separate and distinct patching cycles. Relying solely on OS patches will leave the SQL Server instance vulnerable.

B. Co-locating the web server (IIS) and the database server (SQL) on the same machine violates the principle of defense-in-depth and increases the attack surface.

C. Integrated Windows authentication is the recommended and more secure method for SQL Server, as it avoids storing credentials in connection strings and leverages robust domain authentication.

---

1. Microsoft Corporation. (2023). SQL Injection. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/sql/relational-databases/security/sql-injection.

Reference Detail: The "Mitigating SQL Injection" section explicitly states

"The primary defense against SQL injection is to treat all user input as untrusted... by using parameterized queries." This directly supports the correctness of option D.

2. Microsoft Corporation. (2023). Security considerations for a SQL Server installation. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/sql/sql-server/install/security-considerations-for-a-sql-server-installation.

Reference Detail: In the "Authentication Mode" section

it states

"Windows Authentication is the recommended authentication mode." This refutes option C. The document also implicitly supports server role separation (refuting option B) by discussing service accounts and permissions on a component basis

a core tenet of tiered architecture.

3. Zeldovich

N.

& Solar-Lezama

A. (2014). Lecture 12: Web Security. MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology.

Reference Detail: Slides 10-15 of the lecture PDF discuss SQL injection. Slide 11 explicitly shows an example of how concatenating user input into a SQL string leads to a vulnerability

stating the solution is to "Use SQL prepared statements" which prevents user input from being interpreted as code. This supports option D.

4. Microsoft Corporation. (2023). Install SQL Server Servicing Updates. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/sql/database-engine/install-windows/install-sql-server-servicing-updates.

Reference Detail: This document outlines the separate processes for applying updates (Cumulative Updates

Service Packs) to SQL Server

demonstrating that it is a distinct process from standard Windows OS patching. This refutes option A.