CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Output encoding

  Why this is correct

  When user-supplied data is rendered back to a client, output encoding converts special characters (like <, >, &, ", ') into their entity equivalents (e.g., &lt;, &gt;). This process prevents the browser from interpreting these characters as active content or HTML tags, effectively neutralizing any embedded malicious scripts and ensuring they are displayed as harmless text rather than executed.

• ✓

  Implementing Content Security Policy (CSP)

  Why this is correct

  Content Security Policy (CSP) is a powerful browser-side security mechanism that allows web administrators to define trusted sources of content (scripts, stylesheets, images, etc.) through HTTP headers. By specifying directives like script-src 'self', CSP instructs the browser to only execute scripts originating from the same domain, thereby preventing the execution of injected malicious scripts from untrusted sources, even if they manage to bypass input validation and output encoding.

• ✗

  Disabling JavaScript in the client browser

  Why it's wrong here

  While disabling JavaScript in the client browser would prevent the execution of most XSS payloads, it is not a practical or effective mitigation technique for web application developers. This approach severely degrades user experience by breaking essential website functionality, places the burden on the end-user, and does not address the underlying vulnerability on the server or application side that allows script injection in the first place.

• ✗

  Using HTTPS for all communications

  Why it's wrong here

  HTTPS provides encryption for data in transit, ensuring confidentiality and integrity between the client and server by preventing eavesdropping and tampering. However, HTTPS does not protect against XSS attacks, which exploit vulnerabilities in how a web application processes and renders user-supplied data. An XSS payload, even if delivered over an encrypted channel, will still execute if the application fails to properly validate input or encode output.

• ✓

  Input validation

  Why this is correct

  Input validation involves rigorously checking all user-supplied data against a predefined set of rules to ensure it conforms to expected formats, types, and lengths, and does not contain malicious characters or patterns. By sanitizing or rejecting input that includes script tags, event handlers, or other potentially dangerous constructs at the earliest possible point (e.g., on the server-side), input validation acts as a crucial first line of defense against XSS and other injection attacks.

Go deeper

Related to this question