Answer-first summary for fast verification
Answer: Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.
The question describes a Cross-Site Scripting (XSS) vulnerability where user input is included in web pages without proper validation. Option D is the correct answer because it directly addresses both detection and remediation of XSS vulnerabilities. Web Security Scanner can simulate XSS attacks to identify vulnerabilities, and using a templating system with contextual auto-escaping is the recommended fix for XSS, as it automatically escapes user input based on context. The community discussion strongly supports D with high upvotes (10, 7, etc.) and references to Google documentation confirming Web Security Scanner's ability to simulate XSS attacks and the effectiveness of contextual auto-escaping. Option A is incorrect as Cloud IAP focuses on identity-aware access, not input validation. Option B is suboptimal; while Cloud Armor can help mitigate some attacks, it doesn't fix the root cause in the code. Option C is misleading as Web Security Scanner primarily detects runtime vulnerabilities like XSS, not outdated libraries, and the question emphasizes input validation issues, not library updates.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
Your company's development team has identified that a web application hosted in a staging GKE environment dynamically includes user data in web pages without proper input validation. This flaw could enable an attacker to execute malicious scripts and display arbitrary content in a victim's browser if deployed to production.
How should you remediate and prevent this vulnerability?
A
Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.
B
Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.
C
Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.
D
Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.
No comments yet.