Scenario: When reviewing the activity logs for a web application, a Citrix Engineer notices a high number of requests for the page, /setup.aspx. Further investigation reveals that most of these…

The correct answer is C. Start URL with URL Closure. See the full explanation below for the reasoning.

Question

Scenario: When reviewing the activity logs for a web application, a Citrix Engineer notices a high number of requests for the page, /setup.aspx. Further investigation reveals that most of these requests originated from outside the network. Which protection can the engineer implement to prevent this?

Options

AHTML Cross-Site Scripting (XSS)
BCookie Consistency
CStart URL with URL Closure
DBuffer Overflow

How the community answered

(34 responses)

A
15% (5)
B
6% (2)
C
76% (26)
D
3% (1)

Community Discussion

Dervla O.Jun 26, 2026

Start URL with URL Closure is correct here because it lets you define exactly which URLs are valid entry points to your application, so anything hitting /setup.aspx from an outside source gets blocked before it ever reaches the server. The other options address different threat categories entirely, XSS handles script injection, Cookie Consistency validates session tokens, and Buffer Overflow guards against oversized input payloads, none of which are the right tool for restricting unauthorized entry points.

Yusuf A.Jun 27, 2026

URL Closure does lock down those entry points, but worth noting it works hand in hand with your HTTP request validation because an attacker can still craft a direct POST to a valid URL and bypass the closure if the server is not also checking the referrer or enforcing a proper session state before that first request is even processed.

Toby R.Jun 26, 2026

Start URL with URL Closure is the right call here. The scenario is a classic case where external traffic is hitting a sensitive page that should never be directly reachable from outside, and Start URL lets you define which URLs are valid entry points into the app. URL Closure tightens that further by making sure users can only access URLs that were reached through a valid navigation path starting from one of those approved entry points. XSS and Buffer Overflow are completely different attack categories, and Cookie Consistency checks session cookies, not whether the request origin is legitimate for that resource.

Yusuf A.Jun 24, 2026

Saw this exact scenario on my exam, Start URL locks down which pages outsiders can even request.

-2

Full 1Y0-341 Practice