Explanation:
The question describes a Cross-Site Scripting (XSS) vulnerability where user input is included in web pages without proper validation. Option D is the correct answer because it directly addresses both detection and remediation of XSS vulnerabilities. Web Security Scanner can simulate XSS attacks to identify vulnerabilities, and using a templating system with contextual auto-escaping is the recommended fix for XSS, as it automatically escapes user input based on context. The community discussion strongly supports D with high upvotes (10, 7, etc.) and references to Google documentation confirming Web Security Scanner's ability to simulate XSS attacks and the effectiveness of contextual auto-escaping. Option A is incorrect as Cloud IAP focuses on identity-aware access, not input validation. Option B is suboptimal; while Cloud Armor can help mitigate some attacks, it doesn't fix the root cause in the code. Option C is misleading as Web Security Scanner primarily detects runtime vulnerabilities like XSS, not outdated libraries, and the question emphasizes input validation issues, not library updates.
Ultimate access to all questions.
Your company's development team has identified that a web application hosted in a staging GKE environment dynamically includes user data in web pages without proper input validation. This flaw could enable an attacker to execute malicious scripts and display arbitrary content in a victim's browser if deployed to production.
How should you remediate and prevent this vulnerability?
A
Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.
B
Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.
C
Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.
D
Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.
No comments yet.