Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ94

Ensuring data protection

You are part of your company's development team. You discovered that your web application, hosted in staging on GKE, dynamically includes user data in web pages without properly validating the supplied data first. This could let an attacker execute gibberish commands and show arbitrary content in a victim user's browser in a production environment.

How should you prevent and remediate this vulnerability?

  • A Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.
  • B Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.
  • C Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.
  • D Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.
Explanation

Untrusted user-supplied data rendered into a page can create an XSS vulnerability, allowing attacker-controlled script or content to run in a victim’s browser. Web Security Scanner can simulate XSS injection, and the recommended remediation is to escape output through a templating system that provides contextual auto-escaping.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!