A developer is building a Python application that lets users search for books by title. The application connects to a SQLite database and executes a query built by concatenating user input directly into the SQL string. After a security review, the developer must refactor the code to prevent SQL injection while minimizing changes. Which approach should the developer take?

Escape single quotes in the user input before concatenating it into the SQL string.

Validate the input with a regex that only allows letters and spaces, then concatenate it into the SQL string.

Use string formatting: cursor.execute(f'SELECT * FROM books WHERE title = "{user_input}"')

Use a parameterized query with a placeholder: cursor.execute('SELECT * FROM books WHERE title = ?', (user_input,))

A security audit reveals that a Python web application is vulnerable to SQL injection because it constructs SQL queries by concatenating user input. The application uses sqlite3. The development team must fix the vulnerability with minimal code changes. Which change should the team make?

Use `sqlite3.Connection` with `isolation_level=None` to disable transactions.

Switch from sqlite3 to a NoSQL database.

Add a middleware that strips single quotes from all user input.

Replace all string concatenation with parameterized queries using `?` placeholders.

Python InstitutePCAD - Certified Associate in Data Analytics with Python

Domain 2Objective 4

SQL for Data Analysts PCAD-31 Practice Questions (Page 3)

Part of the Programming and Database Skills domain, which accounts for 33.3% of the PCAD-31 exam. Python Institute does not publish an official question count, but from its 60-minute exam (~25–40 total, ~8–8 in this domain), expect 2–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

7concepts

33.3%of the exam

Questions 11–15

11foundation · easy
Which Python library provides a built-in module for working with SQLite databases?
Select an answer first
12foundation · easy
Which Python type corresponds to a SQL INTEGER column when fetched from a database?
Select an answer first
13application · medium
A developer is building a Python application that lets users search for books by title. The application connects to a SQLite database and executes a query built by concatenating user input directly into the SQL string. After a security review, the developer must refactor the code to prevent SQL injection while minimizing changes. Which approach should the developer take?
Select an answer first
14application · medium
A security audit reveals that a Python web application is vulnerable to SQL injection because it constructs SQL queries by concatenating user input. The application uses sqlite3. The development team must fix the vulnerability with minimal code changes. Which change should the team make?
Select an answer first
15foundation · easy
Which placeholder is used in a parameterized query with the sqlite3 module?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PCAD-31

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Python Institute. “PCAD-31” is a trademark of its owner, used for identification only.

SQL for Data Analysts PCAD-31 Practice Questions (Page 3)

Questions 11–15

Which Python library provides a built-in module for working with SQLite databases?

Which Python type corresponds to a SQL INTEGER column when fetched from a database?

A security audit reveals that a Python web application is vulnerable to SQL injection because it constructs SQL queries by concatenating user input. The application uses sqlite3. The development team must fix the vulnerability with minimal code changes. Which change should the team make?

Which placeholder is used in a parameterized query with the sqlite3 module?

Keep studying — Programming and Database Skills