A security analyst is writing a Python script to update user email addresses in a PostgreSQL database. The email values are read from an external CSV file and cannot be trusted. Which approach should the analyst use to execute the UPDATE statement safely?

Use string concatenation with the email value after applying a custom escape function.

Use a parameterized query with a placeholder and pass the email as a parameter.

Use an f-string to embed the email directly into the SQL statement.

Use the database's built-in REPLACE function inside the SQL statement.

A startup is building a multi-tenant SaaS application. They expect to support both PostgreSQL and MySQL customers, but they want to avoid vendor lock-in. The team is evaluating SQLAlchemy Core vs. writing raw SQL with a thin abstraction layer. Which consideration is most important when choosing between these approaches?

SQLAlchemy Core requires the team to learn a new query language, which increases development time.

Raw SQL is more portable because it avoids the overhead of an ORM.

Raw SQL with a thin abstraction layer is always faster than using an ORM.

SQLAlchemy Core provides a consistent API and handles SQL dialect differences, reducing the risk of subtle bugs.

GIAC Python Coder

Domain 2Objective 3

Database Interaction GPYC Practice Questions (Page 4)

Part of the Scripting and Automation domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

7concepts

Questions 16–20

16foundation · easy
In Python's DB-API, which connection method permanently saves all changes made during the current transaction?
Select an answer first
17foundation · easy
Which cursor method returns a single row from the result set as a tuple?
Select an answer first
18application · medium
A security analyst is writing a Python script to update user email addresses in a PostgreSQL database. The email values are read from an external CSV file and cannot be trusted. Which approach should the analyst use to execute the UPDATE statement safely?
Select an answer first
19foundation · easy
In Python's sqlite3 module, which method of a connection object is used to create a Cursor object for executing SQL statements?
Select an answer first
20expert · hard
A startup is building a multi-tenant SaaS application. They expect to support both PostgreSQL and MySQL customers, but they want to avoid vendor lock-in. The team is evaluating SQLAlchemy Core vs. writing raw SQL with a thin abstraction layer. Which consideration is most important when choosing between these approaches?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPYC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPYC” is a trademark of its owner, used for identification only.

Database Interaction GPYC Practice Questions (Page 4)

Questions 16–20

In Python's DB-API, which connection method permanently saves all changes made during the current transaction?

Which cursor method returns a single row from the result set as a tuple?

A security analyst is writing a Python script to update user email addresses in a PostgreSQL database. The email values are read from an external CSV file and cannot be trusted. Which approach should the analyst use to execute the UPDATE statement safely?

In Python's sqlite3 module, which method of a connection object is used to create a Cursor object for executing SQL statements?

Keep studying — Scripting and Automation