SY0-701 Question 268
Select 2Application security: Input validation , Secure cookies , Static code analysis , Code signingA company is preparing to release an updated customer portal after a penetration test found two issues: attackers could inject unexpected characters into a search field and manipulate backend queries, and session cookies could be exposed if users were tricked into visiting a malicious site over an unencrypted connection. Management wants the development team to make the most direct code and configuration changes to reduce both risks before release. Which TWO actions should the team take?
- A
Implement server-side input validation using allowlists and parameterized queries for the search field
- B
Set the session cookie with the Secure and HttpOnly attributes
- C
Rely on client-side JavaScript validation to block special characters before the form is submitted
- D
Digitally sign the application build before publishing it
- E
Run static code analysis after deployment to confirm whether end users receive modified cookies
Show answer and explanation
Correct answers: A, B
Explanation
The best answer is to fix the vulnerable input handling and harden session cookie settings. For injection-related issues, Security+ expects candidates to recognize server-side input validation and parameterized queries as practical, real-world controls. OWASP guidance consistently recommends validating input on the server and using parameterized queries to prevent injection. For session protection, cookie attributes matter: Secure restricts transmission to HTTPS, and HttpOnly reduces exposure to client-side script access. Although static code analysis and code signing are important application security practices, they do not directly remediate the two findings described here. Static analysis helps identify coding flaws earlier in the SDLC, and code signing helps verify software integrity and publisher authenticity, but neither is the most direct control for these specific risks.
- A. Correct.
Correct. Server-side input validation is a primary defense against malicious or unexpected input. Using allowlists helps restrict input to known acceptable formats, and parameterized queries prevent user input from being interpreted as part of a SQL command. This directly addresses the risk of query manipulation identified in the scenario.
- B. Correct.
Correct. The Secure attribute helps ensure the browser sends the cookie only over HTTPS, reducing exposure on unencrypted connections. The HttpOnly attribute helps prevent client-side scripts from accessing the cookie, reducing the impact of some cross-site scripting attempts. Together, these are standard protections for session cookies.
- C. Incorrect.
Incorrect. Client-side validation can improve usability, but it is not a security control by itself because an attacker can bypass browser-side checks by intercepting or directly crafting requests. This is a common misconception: client-side validation should complement, not replace, server-side validation.
- D. Incorrect.
Incorrect. Code signing helps recipients verify software integrity and publisher authenticity, which is valuable for software distribution, but it does not directly fix input handling flaws or insecure cookie settings in a web application. Someone might choose this because code signing is an application security concept, but it does not address the two specific findings.
- E. Incorrect.
Incorrect. Static code analysis is useful during development and testing to identify insecure coding patterns before release, but it does not inspect whether deployed users receive altered cookies in transit. That would relate more to transport security testing or traffic inspection. Also, the most direct mitigation in this scenario is to correct the code and cookie configuration themselves.