CISSP Software Development Security Practice Question
A development team is fixing a stored cross-site scripting (XSS) vulnerability in a web application that displays user comments. The application stores comments in a database and renders them in HTML. Which of the following is the most secure approach to prevent XSS?
⚠ Common exam trap
A common misconception is that input sanitization (removing tags) is the best approach, but the CISSP emphasizes that output encoding is the definitive control because it works regardless of how data enters the system and preserves data integrity for legitimate use.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply output encoding based on the context (e.g., HTML entity encoding)
Output encoding (C) is the most secure approach because it neutralizes malicious scripts at the point of rendering, ensuring that user-controlled data is treated as text rather than executable code. For HTML contexts, HTML entity encoding (e.g., `<script>`) prevents the browser from interpreting injected tags, regardless of how the data was stored. This aligns with the defense-in-depth principle and is the primary mitigation for stored XSS as recommended by OWASP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Content Security Policy (CSP) headers to restrict script execution
Why it's wrong here
While Content Security Policy (CSP) headers are a valuable defense-in-depth mechanism, they operate client-side to mitigate the *impact* of XSS by restricting script execution. CSP cannot retroactively fix the underlying server-side vulnerability where malicious scripts are already stored in the database. The core issue of untrusted data being stored and later rendered unsafely remains unaddressed by CSP alone, making it an incomplete solution for remediation.
- ✗
Sanitize input by removing all HTML tags before storing
Why it's wrong here
Removing all HTML tags during input sanitization is an overly aggressive approach that can severely degrade legitimate user functionality, such as allowing rich text formatting. While input validation is crucial, simply stripping tags does not guarantee XSS prevention if other attack vectors exist, and it fundamentally alters the user's intended content. Furthermore, this method is less robust than context-aware output encoding, which preserves data integrity while neutralizing malicious script execution upon rendering.
- ✓
Apply output encoding based on the context (e.g., HTML entity encoding)
Why this is correct
Applying output encoding, specifically HTML entity encoding for HTML contexts, is the most effective and robust solution for preventing stored Cross-Site Scripting (XSS). This process transforms malicious characters (like <, >, &, ", ') into their safe, non-executable representations before rendering them in the browser. By ensuring that user-supplied data is treated as data, not executable code, the browser interprets the encoded script as harmless text, thereby neutralizing the XSS payload.
- ✗
Store comments in a separate domain to isolate them
Why it's wrong here
Storing comments on a separate domain, while potentially a good security practice for isolating user-generated content, does not directly prevent a stored Cross-Site Scripting (XSS) vulnerability. If the separate domain still renders the unsanitized malicious content, the XSS payload will execute within that isolated domain's context. This strategy primarily aims to limit the *blast radius* of an attack by preventing session hijacking or data exfiltration from the main application's domain, rather than eliminating the XSS flaw itself.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.