mediumMultiple SelectObjective-mapped
SSCP Practice Question: Which TWO of the following are effective measures…
Which TWO of the following are effective measures to prevent cross-site scripting (XSS) vulnerabilities in a web application?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a Content Security Policy (CSP).
The correct answers are A and D. Implementing a Content Security Policy (CSP) is an effective browser-side defense that restricts the execution of unauthorized scripts, thereby mitigating XSS attacks. Encoding all user input before displaying it in HTTP responses (output encoding) neutralizes any embedded malicious scripts, preventing them from executing in the user's browser. Option B (WAF) can help detect and block some known XSS payloads but is not a primary prevention measure and can be bypassed. Option C (replacing GET with POST) does not prevent XSS because XSS can occur regardless of the HTTP method used; the vulnerability lies in how input is handled on the server side. Option E (HTTPS) only encrypts data in transit and does not protect against XSS, which is a client-side injection attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a Content Security Policy (CSP).
Why this is correct
CSP restricts sources of executable scripts, mitigating XSS even if injection occurs.
- ✗
Use a web application firewall (WAF) to block known XSS payloads.
Why it's wrong here
WAFs provide detection and blocking but are not a code-level prevention.
- ✗
Replace GET requests with POST for all form submissions.
Why it's wrong here
HTTP method does not impact XSS; both GET and POST can carry malicious data.
- ✓
Encode all user input before displaying it in HTTP responses.
Why this is correct
Output encoding ensures that user-supplied data is treated as text, not executable code.
- ✗
Use HTTPS for all communications.
Why it's wrong here
HTTPS ensures confidentiality, not prevention of XSS.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.