Which Attack Is Best Mitigated by Input Sanitization?
Which of the following examples would be best mitigated by input sanitization?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the ability to identify web-based injection payloads, specifically XSS, as the most directly preventable by input sanitization, while other options like phishing or SSL errors are not code injection.
Input sanitization is a key defense against injection attacks, particularly cross-site scripting (XSS). Exam candidates agree that malicious script tags like <script>alert('Warning!');</script> are the classic example best mitigated by input sanitization.
Choosing the phishing email or the browser privacy warning, because they appear security-related, but they are not mitigated by input sanitization—phishing relies on social engineering and privacy warnings require certificate/trust validation.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is A, which is shown as <script>alert("Warning!");</script>. This is a classic cross-site scripting (XSS) payload. Input sanitization strips or neutralizes dangerous characters like <, >, and script so that user-supplied input cannot be executed as code in a web application. The community comments confirm that the displayed option A is missing due to a rendering issue, but it represents a script tag. As one user notes, the browser will execute whatever appears in the HTML file, making the script a direct XSS vector.
Why the Other Options Are Wrong
Option B (nmap - 10.11.1.130) is a network scanning command; while it could be part of an attack, it is not mitigated by input sanitization—it is a tool execution issue. Option C (email with a free gift card link) is a phishing attempt; social engineering is not prevented by input sanitization but by user awareness and email filtering. Option D (browser connection not private) is a TLS certificate warning; this is addressed by proper certificate validation, not input sanitization. Comments and the suggested answer confirm A is the only code-injection example directly mitigated by input sanitization.
Community Comment Notes
Several comments point out that the original question in the 601 exam shows the full script tag, and the 701 version has a rendering issue on the platform. One commenter with 22 likes explicitly states the answer is A and provides the exact payload. Another commenter humorously notes their browser executed the script from the page, reinforcing how XSS works. These comments validate that the intended correct answer is A and that the missing text is the script tag.
Official Reference
Exam Strategy
On the Security+ exam, look for code snippets containing angle brackets or script tags when the question asks about input sanitization. If the option appears incomplete, infer the intended content from the context—especially if the answer key indicates a script-based attack.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →