Best Mitigations for JavaScript Injection on Web Servers?

An organization's web servers host an online ordering system. The organization discovers that the servers are vulnerable to a malicious JavaScript injection, which could allow attackers to access customer payment information. Which of the following mitigation strategies would be most effective for preventing an attack on the organization's web servers? (Choose two.)

  1. Regularly updating server software and patches Source Reference Answer
  2. Implementing strong password policies
  3. Encrypting sensitive data at rest and in transit
  4. Utilizing a web-application firewall Source Reference Answer
  5. Performing regular vulnerability scans

Community Votes

AD
100%

100% of anonymous learners picked answer AD. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests specific web application defenses, where the trap is choosing generic security measures like encryption or password policies instead of active threat mitigation tools like WAFs and patching.

To prevent malicious JavaScript injection attacks like XSS, the most effective strategies are keeping server software patched and using a Web Application Firewall (WAF). The community consensus strongly supports these two methods for securing web servers against code injection vulnerabilities.

Choosing 'Encrypting sensitive data' (Option C) because the question mentions payment information, confusing data protection with attack prevention.

Community Discussion (4 comments)

Fourgehan 👍 5 Selected: AD
A. Regularly updating server software and patches (Keeping server software and any associated components up to date is essential in preventing known vulnerabilities from being exploited. This includes updating the web server, libraries, frameworks, and other software that could be vulnerable to attack, including JavaScript injection vulnerabilities) D. Utilizing a web-application firewall (A WAF is specifically designed to filter, monitor, and block malicious traffic directed at a web application. It can detect and block a wide range of attacks, including JavaScript injection, cross-site scripting (XSS), and other common web-based threats)
9149f41 👍 1 Selected: AD
The question is to protect the web server only from JavaScript injection. Strong passwords, data encryption, and vulnerability checks cannot protect javascript injection. Only update and patch the web server, and WAF can protect JavaScript, in fact, from any injection attack.
ProudFather 👍 1 Selected: DE
A web application firewall (WAF) is specifically designed to protect web applications from attacks like SQL injection, cross-site scripting (XSS), and other web-based vulnerabilities. It can filter and block malicious requests, preventing attackers from exploiting vulnerabilities in the web application. Regular vulnerability scans help identify and address vulnerabilities in the web servers and applications. This includes identifying and patching the vulnerability that allowed the JavaScript injection.
AriGarcia 👍 2 Selected: AD
Keeping server software up-to-date ensures that known vulnerabilities, including those that could be exploited for JavaScript injection, are patched. Many attacks exploit outdated software, so this is a critical step in mitigation. A WAF is specifically designed to detect and block malicious web traffic, including JavaScript injection attacks. It inspects incoming HTTP/S requests and can filter out malicious payloads targeting vulnerabilities in web applications.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Regularly updating server software (Option A) patches the underlying vulnerabilities that allow JavaScript injection, such as flaws in libraries or frameworks. Utilizing a Web Application Firewall (Option D) provides a dedicated security layer that inspects HTTP traffic and actively blocks malicious scripts before they reach the application.

Why the Other Options Are Wrong

Strong password policies (Option B) do not mitigate code injection attacks, which target input validation rather than authentication. Encrypting data (Option C) protects the confidentiality of data at rest or in transit but does not prevent the malicious code from executing in the first place. While vulnerability scans (Option E) are useful for identifying issues, they are a detection mechanism rather than a prevention mechanism like a WAF.

Community Comment Notes

Community members emphasize that updates address the root cause of the vulnerability, while WAFs serve as a critical shield against known attack signatures. One useful comment clarified that while vulnerability scans are important, they do not offer the immediate, active protection required to stop an ongoing injection attempt compared to a WAF.

Official Reference

Exam Strategy

Focus on the specific attack vector—in this case, injection—and choose options that directly address code execution or traffic filtering. Avoid answers that simply protect the data (like encryption) if the question asks how to prevent the attack itself.

Related Analysis

Which of the following considerations is the most important

S-Grade

An organization would like to store customer data on a separ

S-Grade

A legacy device is being decommissioned and is no longer rec

S-Grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide