Examkin

Question

Difficulty: EasyApplication and Software Vulnerabilities

A security administrator is reviewing findings from a static application security testing (SAST) tool scan on an enterprise web portal. The scan identified several software flaws caused by improper handling of user input. Which of the following software security practices directly mitigate input validation and injection vulnerabilities such as Cross-Site Scripting (XSS) and SQL Injection (SQLi)? (Select TWO.)

  1. Implementing contextual output encoding before rendering user input in web pagesAnswer
  2. Utilizing parameterized queries for all back-end database operationsAnswer
  3. C
    Deploying a layer 3 network firewall to filter incoming IP address traffic
  4. D
    Enforcing multi-factor authentication for user login sessions

Answer

The effective mitigations for input validation and injection flaws are implementing contextual output encoding and utilizing parameterized queries.
Contextual output encoding converts potentially harmful characters (such as HTML tag delimiters) into safe display representations before rendering in the browser, directly mitigating Cross-Site Scripting (XSS). Parameterized queries force the database interpreter to handle user input strictly as data values separate from the SQL query syntax, directly preventing SQL Injection (SQLi).

Step-by-Step Solution

1
Analyze the vulnerability types identified in the scenario
The target vulnerabilities are Cross-Site Scripting (XSS) and SQL Injection (SQLi), both of which arise from improper handling of user-supplied input.
Identifying the root cause ensures appropriate application-level security controls are selected.
2
Evaluate application-layer mitigation mechanisms
Contextual output encoding prevents browser execution of malicious scripts (mitigating XSS), while parameterized queries (prepared statements) ensure database engines treat input strictly as data parameters rather than executable SQL commands (mitigating SQLi).
These controls target input sanitization and command separation directly within application code.
3
Exclude ineffective network and authentication controls
Layer 3 firewalls and multi-factor authentication address network traffic routing and identity verification respectively, neither of which alters how application code processes input payloads.
Distinguish between infrastructure/access management controls and software development defenses.

Key Concept

Application Input Sanitization and Parameterization Mitigations
Estimated Time:1m 0s
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic