CISSP Software Development Security Practice Question
A security team is conducting a penetration test on a web application. They identify that the application is vulnerable to reflected cross-site scripting (XSS). Which of the following is the most effective mitigation?
⚠ Common exam trap
Many candidates confuse input validation (Option C) with output encoding, but the CISSP emphasizes that output encoding is the definitive control for injection flaws because it ensures data is treated as data regardless of input validation failures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encoding all user-supplied data before reflecting it in the response
Reflecting user-supplied data without proper encoding allows an attacker to inject arbitrary HTML/JavaScript that executes in the victim's browser. Output encoding (e.g., HTML entity encoding for context like <script> to <script>) neutralizes the injected script by treating it as data rather than executable code. This directly addresses the root cause of reflected XSS—failure to separate user input from executable content in the response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using HTTPS to encrypt traffic
Why it's wrong here
Using HTTPS encrypts the communication channel between the client and server, protecting data confidentiality and integrity during transit. However, HTTPS does not inspect or sanitize the content of the data itself. Therefore, if a web application reflects unsanitized user input containing a malicious script, HTTPS will securely deliver that script to the browser, where it can still execute and lead to a Cross-Site Scripting (XSS) attack.
- ✗
Implementing a Content Security Policy (CSP) with strict directives
Why it's wrong here
Implementing a Content Security Policy (CSP) with strict directives provides a crucial defense-in-depth mechanism by restricting the sources from which a browser can load resources like scripts and styles. While a robust CSP can significantly mitigate the *impact* of an XSS attack by preventing script execution or data exfiltration, it does not prevent the initial injection of malicious script into the Document Object Model (DOM). Output encoding is a primary control that stops the injection from occurring at its source.
- ✗
Validating input against a whitelist of allowed characters
Why it's wrong here
Validating input against a whitelist of allowed characters is an essential security practice that helps ensure data conforms to expected formats and types, potentially blocking many injection attempts at the input stage. However, creating a comprehensive whitelist that accounts for all legitimate inputs across diverse contexts (e.g., HTML, JavaScript, URL) while simultaneously blocking all XSS vectors is extremely challenging and prone to bypasses. Output encoding offers a more robust and context-aware defense by neutralizing malicious code when it is reflected.
- ✓
Encoding all user-supplied data before reflecting it in the response
Why this is correct
Encoding all user-supplied data before reflecting it in the response is the primary and most effective defense against reflected Cross-Site Scripting (XSS) attacks. This process transforms potentially malicious characters (e.g., '<', '>', '&') into their safe, non-executable HTML entity equivalents (e.g., '<', '>', '&'). By ensuring the browser interprets user input as inert data rather than executable code, this practice directly prevents the injection and execution of malicious scripts within the user's browser.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.