CISSP Software Development Security Practice Question
A security architect is reviewing a web application's design and identifies several potential vulnerabilities. Which TWO of the following are effective mitigations for cross-site scripting (XSS) attacks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enabling Content Security Policy (CSP)
Output encoding ensures user input is treated as data, and Content Security Policy (CSP) restricts sources of executable scripts. Input validation can help but is not as effective alone; whitelist validation is emphasized, but output encoding and CSP are primary defenses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enabling Content Security Policy (CSP)
Why this is correct
Content Security Policy (CSP) is a crucial security mechanism that allows web administrators to define trusted sources for content, such as scripts, stylesheets, and images, that a user agent is permitted to load for a given page. By restricting script execution to only approved origins, CSP significantly mitigates Cross-Site Scripting (XSS) attacks, preventing browsers from executing malicious scripts injected from untrusted sources, even if an injection vulnerability exists. This policy acts as a powerful, browser-enforced second layer of defense.
- ✗
Using CSRF tokens
Why it's wrong here
CSRF tokens are specifically designed to prevent Cross-Site Request Forgery (CSRF) attacks by ensuring that all state-changing requests originating from a user's browser are legitimate and intended by the user. These unique, unpredictable tokens validate that a request truly came from the actual web application, not a malicious third-party site attempting to trick the user. While essential for web security, CSRF tokens do not protect against XSS, which involves injecting and executing malicious scripts within the user's browser context.
- ✗
Disabling client-side scripts entirely
Why it's wrong here
Disabling client-side scripts entirely would indeed prevent XSS attacks by eliminating the execution vector for any malicious JavaScript. However, this approach is highly impractical and would severely degrade or completely break the functionality of most modern web applications, which heavily rely on JavaScript for dynamic content, interactivity, and an enhanced user experience. It represents a technically effective but functionally unfeasible solution for real-world applications that require client-side processing.
- ✗
Implementing parameterized queries
Why it's wrong here
Parameterized queries are a robust defense mechanism specifically against SQL injection attacks. They function by strictly separating the SQL code from user-supplied data, ensuring that input values are treated purely as data and never as executable commands within the database query. This mechanism prevents attackers from manipulating database queries. However, parameterized queries offer no protection against XSS, which targets the client-side browser and involves injecting scripts into the HTML output, not manipulating backend database commands.
- ✓
Using output encoding
Why this is correct
Output encoding, also known as escaping, is a fundamental defense against XSS attacks. It involves converting potentially malicious characters in user-supplied data into their safe entity equivalents (e.g., '<' to '<', '>' to '>') before displaying them in the web browser. This ensures that the browser interprets the data as literal text rather than executable HTML or JavaScript code, effectively neutralizing injected scripts and preventing them from running in the user's browser.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.