Exam SY0-601 topic 1 question 604 discussion

Am I tweaking? I dont see an answer for A

Which of the following examples would be best mitigated by input sanitization? A. XSS (Correct Answer) B. nmap -p- 10.11.1.130 C. Email message: “Click this link to get your free gift card.” D. Browser message: “Your connection is not private.”

it's A. Actually, the fact you don't see it, means this website admin dare not to put it as a text string but make it an image, this along means choice A is dangerous and needs to be sanitized. lmao ~

C because that link's querystring can be modified by a hacker, like so: www.website.com/[email protected] the email address would most likely be a database field. An SQLi could be appended to the query string (and not necessarily an injection that would produce data, but one that could, for example, TRUNCATE or DROP a table, or some other nasty)

What is the answer for A?

Don't see the A answer but others make no sense.

Apparently A. XSS ( Cross Site Scripting )

I don't know this one, so I go with the majority...

Input sanitization is a cybersecurity measure of checking, cleaning, and filtering data inputs from users, APIs, and web services of any unwanted characters and strings to prevent the injection of harmful codes into the system. Input sanitization prevent: SQLi and XSS So A. if there is an XSS

C. Email message: “Click this link to get your free gift card.” Input sanitization involves filtering and cleaning user or external input to remove potentially harmful or malicious content. In the case of email messages, input sanitization can help prevent users from clicking on links or downloading attachments that may lead to phishing attacks, malware, or other security threats. By sanitizing the content of emails, you can reduce the risk associated with deceptive or malicious email messages. The other examples are not directly related to input sanitization:

C. Email message: “Click this link to get your free gift card.” Input sanitization is a technique primarily used to validate and clean user or external input to prevent security vulnerabilities or malicious data from affecting a system, especially in web applications and data entry forms. In this case, the email message involves user interaction and clicking a link, which can potentially lead to security risks such as phishing or malicious links. Input sanitization in email content can help filter and validate links to prevent users from clicking on potentially harmful or malicious links. This C option represents a scenario where input sanitization (in the context of validating and cleaning the content of an email message) can play a role in mitigating security risks.

I go with A The best example that can be mitigated by input sanitization is XSS (Cross-Site Scripting) attack1. Input sanitization is the process of cleaning up user input data to prevent attacks such as XSS and protect the application from data corruption2. XSS is a type of security vulnerability that allows an attacker to inject malicious code into a web page viewed by other users. The attacker can then steal user data or perform actions on behalf of the user1. In contrast, nmap -p- 10.11.1.130 is a port scanning tool used to identify open ports on a network3. Email message: “Click this link to get your free gift card.” and Browser message: “Your connection is not private.” are examples of phishing and SSL/TLS certificate errors respectively

Its A, which is code that was run on the browser and you cant see (XSS attack)

The most common techniques used against weak inputs are probably cross-site scripting (XSS) attacks, which involves attackers injecting malicious scripts into otherwise trustworthy websites.

I also want to point out that Input Sanitization is on the COMPTIA objectives

Input sanitization is a technique used to cleanse and validate user input to prevent the introduction of malicious or unwanted data into a system. In the case of the email message, input sanitization could be used to check the validity of the link provided in the email and ensure it does not contain any malicious content or lead to a phishing website.