An organization's web servers host an online ordering system. The organization discovers that the servers are vulnerable to a malicious JavaScript injection, which could allow attackers to access…

Question

Options

• ARegularly updating server software and patches
• BImplementing strong password policies
• CEncrypting sensitive data at rest and in transit
• DUtilizing a web-application firewall
• EPerforming regular vulnerability scans
• FRemoving payment information from the servers

• A
  79% (19)
• B
  13% (3)
• C
  4% (1)
• E
  4% (1)

Explanation

Regularly updating server software (A) directly closes known vulnerabilities - JavaScript injection flaws like XSS are frequently patched, so an up-to-date server reduces the exploitable attack surface. A Web Application Firewall (D) is the most targeted defense because it inspects incoming HTTP traffic in real time, detecting and blocking malicious script payloads before they ever reach the application.

Why the others fall short:

• B (Strong passwords) addresses credential-based attacks, not code injection - a stronger password does nothing to stop a script from running.
• C (Encryption) protects data in storage and transit, but if injected JavaScript executes in a victim's browser, it can harvest payment data before encryption applies.
• E (Vulnerability scans) is a detective control, not a preventive one - it finds problems but doesn't stop an attack in progress.
• F (Remove payment data) would eliminate the target but makes the ordering system nonfunctional; it's avoidance, not mitigation.

Memory tip: For injection attacks, think "Patch the door, post a guard" - patching (A) closes the known hole in the wall, and a WAF (D) is the guard who checks everyone trying to come in.

No community discussion yet for this question.