How to Best Mitigate Command Injection via User-Agent Headers?
Short answer
A Input sanitization
Question
Key Takeaways
This question tests your ability to identify command injection patterns in server logs and recognize that runtime input filtering, rather than development-phase tools, stops active exploitation.
Command injection attacks frequently exploit unfiltered data in HTTP headers to execute system commands. Industry experts and candidates consistently agree that robust input sanitization is the definitive control to block such exploits at the application layer.
Common mistake: Candidates often choose static code analysis because it sounds proactive, but it only scans source code for vulnerabilities and cannot actively intercept or block live malicious requests in production environments.
Expert Analysis
Why the Answer Is Correct
The log excerpt displays a malicious User-Agent string containing shell metacharacters and command syntax, which is a textbook indicator of an OS command injection attempt. Input sanitization directly addresses this by validating, escaping, or stripping dangerous characters before the application processes the request. As noted in the top comment, this control prevents the backend from interpreting user-supplied data as executable system commands.
Why the Other Options Are Wrong
Secure cookies protect session integrity and prevent theft but do nothing to stop command execution via headers. Static code analysis is a preventive measure performed during development to find flaws early, but it offers no real-time protection against live attacks. Sandboxing isolates applications to limit damage after exploitation occurs, making it a reactive containment strategy rather than a prevention control.
Community Comment Notes
Community feedback overwhelmingly supports input sanitization as the correct mitigation. Comment 1 accurately identifies the payload as a command injection attempt targeting the User-Agent field. Comment 2 provides practical implementation examples, showing how to strip shell metacharacters to neutralize the threat. These insights reinforce the importance of recognizing injection signatures and applying immediate input controls.
Official Reference
- https://owasp.org/www-community/attacks/Command_Injection
- https://help.comptia.org/hc/en-us/articles/360049075854-SY0-701-CompTIA-Security-Learning-Series
- https://cwe.mitre.org/data/definitions/78.html
These links open the official vendor documentation in a new tab.
Exam Strategy
When analyzing log-based questions, always map the observed artifact to its corresponding attack category first. Remember that prevention controls like input validation and WAFs are prioritized over detection or containment tools when asked for the 'best' mitigation against active exploitation attempts.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →
, etc.) Command separators Path traversal characters Sanitized Code in bash ( in question, it is a shell command): sanitized_ua=$(printf '%q' "$(echo "$user_agent" | tr -d '$;|')")