Assume a business-crucial web-site of some company that is used to sell handsets to the customers worldwide. All the developed components are reviewed by the security team on a monthly basis. In…

Question

Options

• AExternal script contents could be maliciously modified without the security team knowledge
• BExternal scripts have direct access to the company servers and can steal the data from there
• CThere is no risk at all as the marketing services are trustworthy
• DExternal scripts increase the outbound company data traffic which leads greater financial losses

• A
  69% (22)
• B
  3% (1)
• C
  13% (4)
• D
  16% (5)

Explanation

The core risk of embedding third-party JavaScript from an external server is a supply-chain attack. Because the scripts live on the marketing company's servers-not the company's own infrastructure-the in-house security team has no visibility into or control over them. If the marketing company's servers are compromised, an attacker can silently alter the script content (e.g., inject a keylogger or skimmer). The malicious code then runs in every visitor's browser with full access to the page DOM, form fields, and cookies-all without the monthly internal security review ever catching it. Choice B is wrong because browser same-origin policy prevents external scripts from directly accessing the company's backend servers; they run client-side. Choice C is wrong because even reputable third parties can be breached. Choice D is wrong because network traffic volume is not the primary security concern here.

No community discussion yet for this question.