hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A security assessment reveals that a web…
A security assessment reveals that a web application uses client-side input validation exclusively. What is the most likely security risk?
⚠ Common exam trap
Watch out — candidates often confuse client-side validation with a security control, when in fact it is only a usability feature that provides no real security against a determined attacker.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An attacker can submit malicious data directly to the server without client-side constraints.
Client-side validation (e.g., JavaScript in the browser) can be bypassed by intercepting and modifying HTTP requests using tools like Burp Suite or cURL. Since the server does not re-validate the input, an attacker can submit crafted payloads (e.g., SQL injection, command injection) directly to the server, leading to data breaches or code execution. This violates the principle of defense in depth, where validation must occur on the server side regardless of client-side checks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attacker can inject malicious scripts that execute on the client side.
Why it's wrong here
While client-side validation can prevent some malformed inputs from reaching the server, its absence does not directly cause Cross-Site Scripting (XSS). XSS vulnerabilities primarily arise from a lack of proper output encoding on the server side when user-supplied data is rendered back into a web page. If the server fails to sanitize or encode user input before displaying it, malicious scripts can execute in other users' browsers, regardless of initial client-side input checks.
- ✓
An attacker can submit malicious data directly to the server without client-side constraints.
Why this is correct
Client-side validation, implemented in the user's browser, can be easily bypassed by an attacker using various methods, such as disabling JavaScript, manipulating browser developer tools, or intercepting and modifying requests with proxy tools like Burp Suite. Without robust server-side validation, the application's backend will process any data received, including malicious inputs, directly from the attacker, leading to potential vulnerabilities like SQL injection, command injection, or data corruption, as the server trusts the unverified input.
- ✗
The application will have poor user experience due to slow responses.
Why it's wrong here
Client-side validation is designed to provide immediate feedback to users about incorrect or missing input fields without requiring a round trip to the server. This instantaneous feedback significantly improves the user experience by reducing wait times and preventing unnecessary server load. If client-side validation is absent, every input error would necessitate a server request and response, leading to a noticeably slower and more frustrating user interaction, not a faster one.
- ✗
The client-side code can be obfuscated but not decrypted.
Why it's wrong here
Client-side code, typically JavaScript, HTML, and CSS, is inherently delivered to and executed by the user's browser, making it fully visible and accessible. While obfuscation techniques can make the code harder for humans to read and understand, they do not encrypt it or make it impossible to reverse engineer. An attacker can still analyze, de-obfuscate, or simply bypass the client-side logic entirely, as the code must ultimately be executable by the browser, rendering it vulnerable to inspection and manipulation.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security assessment
A security assessment is a systematic evaluation of an organization’s systems, networks, and applications to identify vulnerabilities, threats, and risks, and to recommend improvements.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.