Exam Professional Cloud Security Engineer topic 1 question 92 discussion

Option D is correct as using web security scanner will allow to detect the vulnerability and templating system

Answer is D. There is mention about simulating in Web Security Scanner. "Web Security Scanner cross-site scripting (XSS) injection testing *simulates* an injection attack by inserting a benign test string into user-editable fields and then performing various user actions." https://cloud.google.com/security-command-center/docs/how-to-remediate-web-security-scanner-findings#xss

"D" Using Web Security Scanner in Security Command Center to find XSS vulnerabilities. This page explains recommended mitigation techniques such as using contextual auto-escaping. https://cloud.google.com/security-command-center/docs/how-to-remediate-web-security-scanner-findings#xss

D. Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

clear D everything is explicated here : https://cloud.google.com/security-command-center/docs/how-to-remediate-web-security-scanner-findings Web Security Scanner cross-site scripting (XSS) injection testing simulates an injection attack by inserting a benign test string into user-editable fields and then performing various user actions. Custom detectors observe the browser and DOM during this test to determine whether an injection was successful and assess its potential for exploitation. There are various ways to fix this issue. The recommended fix is to escape all output and use a templating system that supports contextual auto-escaping.

It should be C because the web security scanner will identify the library known to contain the security issue as in the examples here - https://cloud.google.com/security-command-center/docs/how-to-use-web-security-scanner#example_findings . Once the security issue is identified, the vulnerability can be fixed by a secure version of that library.

Ans : D

C, D is wrong, as Security Scanner can't "simulate" anything. It's a scanner. B is not right, as Armor can't do input data validation, it just deny/allow IP/CIDR.

https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview Security Scanner should be able to scan for XSS vulnerabilities as well. Option D is better.

B , https://cloud.google.com/armor

Ans - D

Answer is B. Web Security Scanner can look for XSS vulnerabilities but can't simulate XSS injection attack. https://cloud.google.com/armor/docs/rule-tuning#cross-site_scripting_xss

D. https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview