Which technique prevents cross-site scripting in web forms?

SY0-701 By islever Editorial Last updated

Short answer

C Input validation

Question

A security team is reviewing the findings in a report that was delivered after a third party performed a penetration test. One of the findings indicated that a web application form field is vulnerable to cross-site scripting. Which of the following application security techniques should the security analyst recommend the developer implement to prevent this vulnerability?
  1. Secure cookies
  2. Version control
  3. Input validation Correct Answer
  4. Code signing

Key Takeaways

This question tests remediation strategies for XSS, where the trap is confusing input validation with secure cookie settings or code integrity measures.

To prevent Cross-Site Scripting (XSS) vulnerabilities identified in penetration tests, security analysts recommend implementing input validation. This technique ensures that malicious scripts cannot be injected into web application form fields.

Common mistake: Choosing 'Secure cookies' (Option A) is a common error because it relates to web security, but it protects session IDs rather than preventing script injection.

Expert Analysis

Why the Answer Is Correct

Input validation is the primary defense against Cross-Site Scripting (XSS) attacks. By strictly validating user input in form fields, developers can ensure that malicious scripts, such as JavaScript, are not accepted or processed by the application. This effectively neutralizes the attack vector identified in the penetration test.

Why the Other Options Are Wrong

Secure cookies (A) help protect session tokens from interception but do not prevent script injection into form fields. Version control (B) is a development practice for tracking changes and does not provide runtime security against active threats. Code signing (D) verifies the source and integrity of code but does not filter or validate user input.

Community Comment Notes

The community unanimously supports Option C, highlighting that the goal is to stop JavaScript code from being inputted and executed. Comments clarify that while other options are security measures, they do not address the specific mechanism of XSS injection.

Official Reference

https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When you see Cross-Site Scripting (XSS), immediately look for Input Validation or Output Encoding as the solution. Do not be distracted by other security terms that address different vulnerabilities like session management or code integrity.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. hasquaati 👍 9 Answered C
    Answer is C. Its important to make sure that javascript code can not be inputted and executed into Form fields.
  2. PAWarriors 👍 6 Answered C
    Correct answer is C. Cross-Site Scripting (XSS) can be mitigated with proper input validation.
  3. SHADTECH123 👍 4 Answered C
    A security team is reviewing the findings in a report that was delivered after a third party performed a penetration test. One of the findings indicated that a web application form field is vulnerable to cross-site scripting. Which of the following application security techniques should the security analyst recommend the developer implement to prevent this vulnerability? A. Secure cookies B. Version control C. Input validation D. Code signing

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide