What is a primary security measure to prevent Cross-Site Scripting (XSS) attacks?

The correct answer is A. Implementing Content Security Policy (CSP). Content Security Policy (CSP) directly combats XSS by restricting which scripts, styles, and resources a browser is permitted to load and execute - blocking the injected malicious scripts that define XSS attacks. Option B (database encryption) protects data at rest and has no bea

Web Application Security

Question

Options

AImplementing Content Security Policy (CSP)
BUsing database encryption
CEnabling CORS on the server
DUsing parameterized queries

How the community answered

(34 responses)

A
88% (30)
B
3% (1)
C
6% (2)
D
3% (1)

Explanation

Content Security Policy (CSP) directly combats XSS by restricting which scripts, styles, and resources a browser is permitted to load and execute - blocking the injected malicious scripts that define XSS attacks. Option B (database encryption) protects data at rest and has no bearing on script injection in the browser. Option C (CORS) controls cross-origin resource sharing between servers, not script execution within a page. Option D (parameterized queries) is the correct defense against SQL injection, not XSS - a common mix-up on security exams.

Memory tip: Match the attack to its layer - XSS lives in the browser, so the fix (CSP) lives in the browser; SQL injection lives in the database, so the fix (parameterized queries) lives in the database layer. If you remember that, you'll never swap B and D either.

Topics

#XSS Prevention#Content Security Policy#Web Application Security#Input Validation

Community Discussion

No community discussion yet for this question.

Full 112-52 Practice