Which technique prevents cross-site scripting in web forms?
A security team is reviewing the findings in a report that was delivered after a third party performed a penetration test. One of the findings indicated that a web application form field is vulnerable to cross-site scripting. Which of the following application security techniques should the security analyst recommend the developer implement to prevent this vulnerability?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests remediation strategies for XSS, where the trap is confusing input validation with secure cookie settings or code integrity measures.
To prevent Cross-Site Scripting (XSS) vulnerabilities identified in penetration tests, security analysts recommend implementing input validation. This technique ensures that malicious scripts cannot be injected into web application form fields.
Choosing 'Secure cookies' (Option A) is a common error because it relates to web security, but it protects session IDs rather than preventing script injection.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Input validation is the primary defense against Cross-Site Scripting (XSS) attacks. By strictly validating user input in form fields, developers can ensure that malicious scripts, such as JavaScript, are not accepted or processed by the application. This effectively neutralizes the attack vector identified in the penetration test.Why the Other Options Are Wrong
Secure cookies (A) help protect session tokens from interception but do not prevent script injection into form fields. Version control (B) is a development practice for tracking changes and does not provide runtime security against active threats. Code signing (D) verifies the source and integrity of code but does not filter or validate user input.Community Comment Notes
The community unanimously supports Option C, highlighting that the goal is to stop JavaScript code from being inputted and executed. Comments clarify that while other options are security measures, they do not address the specific mechanism of XSS injection.Official Reference
Exam Strategy
When you see Cross-Site Scripting (XSS), immediately look for Input Validation or Output Encoding as the solution. Do not be distracted by other security terms that address different vulnerabilities like session management or code integrity.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →