hardMultiple ChoiceObjective-mapped
220-1202 Practice Question: A company uses a web application for internal…
A company uses a web application for internal communication. A security audit reveals that the application is vulnerable to cross-site scripting (XSS). Which browser security feature can help mitigate the risk for users while the application is being patched?
⚠ Common exam trap
Many candidates for the CompTIA A+ exam mistakenly think disabling JavaScript is a viable XSS mitigation, but the trap is that this breaks application functionality and is not a selective security control, whereas CSP provides granular control over script execution without disabling all JavaScript.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement Content Security Policy (CSP) headers on the web server
Content Security Policy (CSP) is a browser security mechanism that allows a web server to specify which sources of content (scripts, styles, images, etc.) are trusted. By implementing CSP headers (e.g., Content-Security-Policy: script-src 'self'), the server instructs the browser to block inline scripts and other potentially malicious content, effectively mitigating XSS attacks even before the application code is patched. CSP operates as a defense-in-depth layer that the browser enforces, reducing the attack surface for users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable pop-up blocker
Why it's wrong here
A pop-up blocker is designed to prevent unsolicited new browser windows or tabs from opening automatically, typically for advertisements or malicious redirects. It operates at the user interface level of the browser and does not inspect or filter the content within an existing web page's Document Object Model (DOM) for malicious scripts. Therefore, it offers no defense against Cross-Site Scripting (XSS) attacks, which involve injecting and executing scripts directly within the current page's context.
- ✗
Configure the browser to use a proxy server
Why it's wrong here
While a proxy server can intercept and potentially filter network traffic between the browser and the web server, its primary function is often for caching, anonymity, or basic content filtering based on URLs or headers. A standard proxy typically does not perform deep packet inspection or content analysis of HTTP responses to identify and block malicious JavaScript embedded within the HTML body that would execute client-side. Thus, it generally cannot prevent a Cross-Site Scripting (XSS) attack where the malicious script is delivered within a seemingly legitimate web page.
- ✓
Implement Content Security Policy (CSP) headers on the web server
Why this is correct
Content Security Policy (CSP) is a powerful security mechanism implemented via HTTP response headers that allows the web server to explicitly define which sources of content (scripts, stylesheets, images, etc.) are permitted to load and execute on a given web page. By establishing a strict CSP, the browser will block any scripts originating from unauthorized domains or any inline scripts not explicitly allowed, effectively preventing the execution of maliciously injected scripts and significantly mitigating Cross-Site Scripting (XSS) vulnerabilities.
- ✗
Disable JavaScript in the browser
Why it's wrong here
Disabling JavaScript globally in a web browser would indeed prevent the execution of any client-side scripts, including malicious ones injected via XSS. However, modern web applications, especially those used for internal communication, rely heavily on JavaScript for dynamic content, interactive features, and overall functionality. Disabling it would render most web applications unusable or severely degrade their user experience, making this an impractical and unacceptable "solution" for maintaining operational efficiency.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.