An auditor is reviewing a SQL query: `SELECT * FROM Employees WHERE Salary > 100000;`. What is the risk of using `SELECT *` in production code?

Answer options:

It retrieves unnecessary data, causing performance issues and potential data exposure if schema changes.

It causes a syntax error.

It automatically deletes data.

It bypasses authentication.

How to approach this question

Identify the efficiency/maintenance risk.

Full Answer

A.It retrieves unnecessary data, causing performance issues and potential data exposure if schema changes.✓ Correct

Using `SELECT *` retrieves all columns. If the table has sensitive columns added later, or large BLOB fields, the application might expose data it shouldn't or suffer performance degradation. Best practice is to list specific columns.

Common mistakes

Thinking `SELECT *` is a security vulnerability like SQL Injection (it's just bad practice).

Question 61 All questions Question 63

Practice the full CPA ISC Practice Exam 3

82 questions · hints · full answers · grading

More questions from this exam

Q01A CPA is advising a client who is migrating their legacy on-premise ERP system to a cloud-based s...Medium Q02During a review of a client's cloud governance structure, an auditor notes that the client uses a...Medium Q03An auditor is evaluating the 'Processing Integrity' principle for a financial institution's loan ...Hard Q04A company uses a batch processing system to update inventory records overnight. The 'Grandfather-...Hard Q05During a walkthrough of the change management process, an auditor observes that the 'Developer' r...Medium

View all 82 questions →