220-1102 Question 451
Single answerCross-site scripting (XSS)A help desk technician reports that users are seeing a pop-up message only when viewing certain support tickets in the company's internal web-based ticketing system. After reviewing one affected ticket, the technician notices the ticket description contains text such as , and the browser executes it when the page is opened. Which of the following is the BEST explanation for this issue?
- A
The ticketing system is vulnerable to cross-site scripting because it does not properly sanitize or encode user-supplied input before displaying it in the browser.
- B
The workstation is infected with a boot sector virus that injects JavaScript into web pages stored on the hard drive.
- C
The issue is caused by a denial-of-service attack that interrupts the browser and triggers script execution from cached pages.
- D
The browser is experiencing phishing redirection because DNS poisoning changed the destination of the ticketing system.
Show answer and explanation
Correct answer: A
Explanation
The best answer is the XSS vulnerability caused by failing to properly sanitize or encode user-supplied input before presenting it in a web page. In practical terms, if a user can place JavaScript into a form field and that script executes in another user's browser, the application is not safely handling untrusted input. This is a common web security issue that support technicians may identify when users report pop-ups, redirects, session theft, or strange page behavior tied to specific records or messages. Best practices from sources such as OWASP recommend context-appropriate output encoding, input validation, and use of security controls such as Content Security Policy to reduce XSS risk. For A+ Core 2, candidates should recognize XSS as a web application attack in which malicious script is delivered through trusted pages viewed in a browser.
- A. Correct.
This is correct. Cross-site scripting (XSS) occurs when a web application accepts untrusted input and returns it to users' browsers without proper validation, sanitization, or output encoding. In this scenario, the script tag was entered into a ticket field and then executed when another user viewed the ticket, which is a classic reflected or stored XSS symptom depending on how the application saves and displays the data. The key issue is the application's handling of user input, not the local workstation.
- B. Incorrect.
This is incorrect. A boot sector virus infects the boot record of a storage device and affects system startup, not the rendering of specific user-entered content inside a web application. Someone might choose this if they are focusing on the fact that code is running unexpectedly, but the scenario points to malicious script embedded in a ticket field and executed by the browser when the page is displayed.
- C. Incorrect.
This is incorrect. A denial-of-service attack is intended to overwhelm a service and reduce availability, not inject executable code into a specific page field. Although performance or availability problems can affect web applications, they do not explain why a script typed into a ticket description runs inside the browser.
- D. Incorrect.
This is incorrect. DNS poisoning can redirect users to a fraudulent or incorrect site, which is related to traffic redirection and phishing risk. However, the scenario describes script execution from content embedded in a legitimate support ticket page. The problem is unsafe handling of user input within the application, not name resolution manipulation.