300-215 · Question #36
Refer to the exhibit. An engineer received a ticket to analyze a recent breach on a company blog. Every time users visit the blog, they are greeted with a message box. The blog allows users to…
The correct answer is A. Validate input on arrival as strictly as possible. The pop-up is a classic stored XSS payload being executed from user comments. Strict server- side input validation (and proper output encoding) prevents malicious script tags from ever being stored or rendered, immediately closing this attack vector.
Question
Refer to the exhibit. An engineer received a ticket to analyze a recent breach on a company blog. Every time users visit the blog, they are greeted with a message box. The blog allows users to register, log in, create, and provide comments on various topics. Due to the legacy build of the application, it stores user information in the outdated MySQL database. What is the recommended action that an engineer should take?
Exhibit
Options
- AValidate input on arrival as strictly as possible.
- BImplement TLS 1.3 for external communications.
- CMatch the web server software for the front-end and back-end servers.
- DUpgrade the MySQL database.
How the community answered
(32 responses)- A78% (25)
- B6% (2)
- C3% (1)
- D13% (4)
Explanation
The pop-up is a classic stored XSS payload being executed from user comments. Strict server- side input validation (and proper output encoding) prevents malicious script tags from ever being stored or rendered, immediately closing this attack vector.
Topics
Community Discussion
No community discussion yet for this question.