SY0-701 Question 269
Select 3Application security: Input validation , Secure cookies , Static code analysis , Code signingA company is releasing a customer portal update after a security review found several issues. Testers discovered reflected XSS in a search field, session cookies being exposed to client-side scripts, and concern that a recent software package uploaded to the deployment repository may have been tampered with. The development manager wants the MOST effective combination of controls to address these findings before release. Which TWO actions should the security team recommend?
- A
Implement server-side input validation and output encoding for the search parameter
- B
Set the session cookie with the HttpOnly and Secure attributes
- C
Rely on static code analysis alone to prevent all future XSS flaws
- D
Require code signing verification for build artifacts before deployment
- E
Store the session ID in local browser storage instead of cookies
Show answer and explanation
Correct answers: A, B, D
Explanation
The best response is a layered set of controls that maps directly to the findings: input validation plus context-appropriate output encoding for the reflected XSS issue, secure cookie attributes to better protect session tokens, and code signing verification to detect tampered deployment artifacts. Static code analysis is valuable as a preventive and detective control during development, but it should complement, not replace, secure coding practices and deployment integrity checks. These recommendations align with widely accepted guidance such as OWASP's recommendations on input validation, XSS prevention, and session management, as well as NIST secure software development practices emphasizing software integrity and verification of release artifacts.
- A. Correct.
Correct. Server-side input validation helps ensure the application only accepts expected characters, length, and format, reducing the attack surface for malicious input. For reflected XSS specifically, output encoding is also essential because validation alone may not neutralize all dangerous payloads in every context. This is a practical remediation for the vulnerable search field.
- B. Correct.
Correct. Setting the session cookie with HttpOnly helps prevent client-side JavaScript from reading the cookie, which reduces the impact of XSS on session theft. The Secure attribute ensures the cookie is sent only over HTTPS, protecting it from interception over unencrypted channels. These are standard secure cookie settings for protecting authenticated sessions.
- C. Incorrect.
Incorrect. Static code analysis is useful for finding insecure coding patterns early in the SDLC, including some XSS-related issues, but it is not sufficient by itself and cannot guarantee prevention of all future XSS flaws. Runtime context, business logic, and output handling still matter. Choosing this option reflects the misconception that a single testing tool replaces layered secure coding practices.
- D. Correct.
Correct. Code signing provides integrity and authenticity assurances for software packages and build artifacts. Verifying signatures before deployment helps detect tampering in the repository or software supply chain. This directly addresses the concern that an uploaded package may have been modified after it was built.
- E. Incorrect.
Incorrect. Storing session identifiers in local storage is generally less secure than properly configured cookies because local storage is accessible to JavaScript and therefore more exposed during XSS events. It also lacks cookie security controls such as HttpOnly. Someone might choose this option thinking it avoids cookie risks, but it usually increases session theft risk.