Which Attack Is Best Mitigated by Input Sanitization?

SY0-701 By islever Editorial Last updated

Question

Which of the following examples would be best mitigated by input sanitization?
  1. nmap - 10.11.1.130
  2. Email message: "Click this link to get your free gift card."
  3. Browser message: "Your connection is not private."

Key Takeaways

The exam tests the ability to identify web-based injection payloads, specifically XSS, as the most directly preventable by input sanitization, while other options like phishing or SSL errors are not code injection.

Input sanitization is a key defense against injection attacks, particularly cross-site scripting (XSS). Exam candidates agree that malicious script tags like <script>alert('Warning!');</script> are the classic example best mitigated by input sanitization.

Common mistake: Choosing the phishing email or the browser privacy warning, because they appear security-related, but they are not mitigated by input sanitization—phishing relies on social engineering and privacy warnings require certificate/trust validation.

Expert Analysis

Why the Answer Is Correct

The correct answer is A, which is shown as <script>alert("Warning!");</script>. This is a classic cross-site scripting (XSS) payload. Input sanitization strips or neutralizes dangerous characters like <, >, and script so that user-supplied input cannot be executed as code in a web application. The community comments confirm that the displayed option A is missing due to a rendering issue, but it represents a script tag. As one user notes, the browser will execute whatever appears in the HTML file, making the script a direct XSS vector.

Why the Other Options Are Wrong

Option B (nmap - 10.11.1.130) is a network scanning command; while it could be part of an attack, it is not mitigated by input sanitization—it is a tool execution issue. Option C (email with a free gift card link) is a phishing attempt; social engineering is not prevented by input sanitization but by user awareness and email filtering. Option D (browser connection not private) is a TLS certificate warning; this is addressed by proper certificate validation, not input sanitization. Comments and the suggested answer confirm A is the only code-injection example directly mitigated by input sanitization.

Community Comment Notes

Several comments point out that the original question in the 601 exam shows the full script tag, and the 701 version has a rendering issue on the platform. One commenter with 22 likes explicitly states the answer is A and provides the exact payload. Another commenter humorously notes their browser executed the script from the page, reinforcing how XSS works. These comments validate that the intended correct answer is A and that the missing text is the script tag.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On the Security+ exam, look for code snippets containing angle brackets or script tags when the question asks about input sanitization. If the option appears incomplete, infer the intended content from the context—especially if the answer key indicates a script-based attack.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. CJfromVA 👍 22 Answered A
    This question is the same on exam topics 601 #604 - The answer is in fact A and it shows "A. <script>alert("Warning!");</script>"
  2. 3dk1 👍 21
    huh, so thats why my browser showed "warning!" when opening this page's questions. hahahaha
  3. jsmthy 👍 11 Answered A
    Your browser is like Ron Burgundy. Whatever shows up on the HTML file, it is going to read it and execute it.
  4. Sole_tone 👍 10
    the Answer is A but it doesn't show anything but what it should be showing is something like this. <script>alert("Warning!");</script> If you look in the 601 study guide that's what it shows
  5. TonyStarChillingFromHeaven 👍 1 Answered A
    A. <script>alert("Warning!");</script>"

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide