Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

A security analyst is evaluating code remediation requirements following an assessment of an enterprise web portal. The evaluation identified two primary software flaws: database queries constructed by concatenating unsanitized user inputs, and user-submitted data reflected directly into rendered HTML responses without escaping. Which of the following mitigation strategies must developers implement to address these specific application vulnerabilities? (Select TWO).

  1. Implement parameterized queries (prepared statements) for all database interactionsAnswer
  2. Apply context-aware output encoding on user data rendered in web pagesAnswer
  3. C
    Deploy stateful network firewalls at the enterprise perimeter to inspect HTTP payload bodies
  4. D
    Enforce multi-factor authentication (MFA) for all web application user logins

Answer

Developers must implement parameterized queries (prepared statements) for database interactions and apply context-aware output encoding on rendered web page data.
The correct mitigations directly address the root causes of the vulnerabilities: parameterized queries (prepared statements) prevent SQL injection by treating input strictly as data parameters, while context-aware output encoding neutralizes Cross-Site Scripting (XSS) by rendering client-side scripts as plain text rather than executable browser code.

Step-by-Step Solution

1
Identify the specific software vulnerability types described in the scenario
Dynamic database string concatenation corresponds to SQL Injection (SQLi), while unescaped user input reflected in HTML corresponds to Reflected Cross-Site Scripting (XSS).
Accurate vulnerability identification is required to select effective code-level mitigations.
2
Determine the appropriate software remediation for SQL Injection
Using parameterized queries (prepared statements) binds user inputs as strongly-typed data values rather than executable code statements.
Prepared statements ensure the database engine compiles the query structure prior to inserting user parameters.
3
Determine the appropriate software remediation for Reflected XSS
Applying context-aware output encoding translates special characters (such as angle brackets and quotes) into harmless HTML entity equivalents prior to rendering.
Output encoding prevents the browser from interpreting user strings as inline executable scripts.

Key Concept

Application Input Validation and Output Sanitization Controls
Estimated Time:1m 30s
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic