PCSE Question 92

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D2

  D. Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

• Chose D2

  clear D everything is explicated here : https://cloud.google.com/security-command-center/docs/how-to-remediate-web-security-scanner-findings Web Security Scanner cross-site scripting (XSS) injection testing simulates an injection attack by inserting a benign test string into user-editable fields and then performing various user actions. Custom detectors observe the browser and DOM during this test to determine whether an injection was successful and assess its potential for exploitation. There are various ways to fix this issue. The recommended fix is to escape all output and use a templating system that supports contextual auto-escaping.

• Chose D10

  Option D is correct as using web security scanner will allow to detect the vulnerability and templating system