A security audit has determined that your web application is vulnerable to a crosssite scripting attack. Which of the following measures are appropriate when building a security policy? (Choose 2)

Restricting cookie length to 1024 bytes addresses potential cookie-based overflow issues, not cross-site scripting vulnerabilities in user input.

Attack signature sets contain patterns that detect known XSS payloads within user-supplied input parameters, blocking script injection attempts before they reach the application. Applying these signatures to any user input parameter is a direct and standard ASM countermeasure against XSS.

Enforcing minimum and maximum value ranges on explicit parameters is an input validation technique against overflow or range-based attacks, not a targeted defense against XSS injection.

Flow-level parameters that selectively allow or block metacharacters (such as angle brackets and quotation marks used in XSS payloads) prevent attackers from injecting script tags or event handlers through those parameters, directly reducing XSS exposure.