Examkin

Question

Difficulty: EasyApplication and Software Vulnerabilities

A web application developer wants to remediate software vulnerabilities that allow attacker-controlled inputs to execute malicious scripts in user browsers or alter database commands. Which of the following secure coding practices should the developer implement to address these application vulnerabilities? (Select TWO.)

  1. Context-aware output encoding before rendering user input in HTML responsesAnswer
  2. Parameterized queries and prepared statements for all database operationsAnswer
  3. C
    Deploying network-level stateful firewalls at the enterprise perimeter
  4. D
    Using role-based access control (RBAC) to authenticate user credentials during session initiation

Answer

The correct secure coding practices are context-aware output encoding and parameterized queries with prepared statements.
Context-aware output encoding neutralizes script execution to mitigate Cross-Site Scripting (XSS), while parameterized queries isolate user data from executable SQL commands to mitigate SQL Injection (SQLi). Both are essential application-level secure coding practices.

Step-by-Step Solution

1
Identify the target application vulnerability types described in the scenario.
Executing scripts in browsers indicates Cross-Site Scripting (XSS), and altering database commands indicates SQL Injection (SQLi).
Accurate identification of vulnerability mechanisms is required to select effective code-level mitigations.
2
Select the appropriate mitigation control for client-side script execution (XSS).
Context-aware output encoding neutralizes special characters so the browser treats input purely as display text.
Encoding prevents script tags from executing in the web browser context.
3
Select the appropriate mitigation control for database command alteration (SQLi).
Parameterized queries ensure database engines treat user input strictly as parameter values rather than executable SQL syntax.
Prepared statements prevent input strings from redefining query logic.

Key Concept

Application Software Vulnerability Remediation and Secure Coding
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic