Google Cloud Professional Cloud Security Engineer — Question 44

You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user's browser in a production environment.
How should you prevent and fix this vulnerability?

Answer options

• A. Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.
• B. Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.
• C. Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.
• D. Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

Correct answer: D

Explanation

The correct answer is D because using Web Security Scanner in staging allows you to identify vulnerabilities like XSS and adopting a templating system with contextual auto-escaping helps prevent such attacks by ensuring that user input is properly sanitized. Options A and B do not directly address the core issue of input validation and XSS prevention, while option C focuses on outdated libraries rather than the immediate vulnerability related to user input handling.