SY0-401 Free Dumps Study Materials
Question 12: A security administrator develops a web page and limits input into the fields on the web page
as well as filters special characters in output. The administrator is trying to prevent which of the
following attacks?
A. Spoofing
B. XSS
C. Fuzzing
D. Pharming
Correct Answer: B
Explanation:
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web
applications. XSS enables attackers to inject client-side script into Web pages viewed by other users.
Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug-in
systems on which they rely. Exploiting one of these, attackers fold malicious content into the content
being delivered from the compromised site. When the resulting combined content arrives at the
client-side web browser, it has all been delivered from the trusted source, and thus operates under
the permissions granted to that system. By finding ways of injecting malicious scripts into web pages,
an attacker can gain elevated access- privileges to sensitive page content, session cookies, and a
variety of other information maintained by the browser on behalf of the user.
By validating user input and preventing special characters, we can prevent the injection of client-side
scripting code.