Discuss Google Professional Cloud Security Engineer Exam Topic 1 Question 101

You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted dat

a. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user's browser in a production environment.

How should you prevent and fix this vulnerability?

AUse Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.

BSet up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.

CUse Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.

DUse Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

Suggested Answer: D

There is mention about simulating in Web Security Scanner. 'Web Security Scanner cross-site scripting (XSS) injection testing *simulates* an injection attack by inserting a benign test string into user-editable fields and then performing various user actions.' https://cloud.google.com/security-command-center/docs/how-to-remediate-web-security-scanner-findings#xss

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Billye 10 months ago

Cloud Armor is great, but we still need to validate inputs too.

Gladys 10 months ago

I think using a templating system is a solid approach!

Ailene 11 months ago

Not sure if just using Cloud IAP is enough to fix this.

Svetlana 11 months ago

Surprised this wasn't caught earlier in staging!

Pansy 11 months ago

Definitely need to validate user input to avoid XSS attacks.

Staci 11 months ago

I feel like we had a similar question on the practice exam, and I chose something related to scanning for vulnerabilities. Was it option C?

Loren 11 months ago

I'm a bit confused about whether using Cloud Armor really helps with the XSS issue. I thought it was more about DDoS protection?

Lezlie 12 months ago

I think option D sounds familiar; we practiced using templating systems that auto-escape input to prevent XSS attacks.

Maile 12 months ago

I remember we discussed the importance of input validation in our last class, but I'm not sure which option directly addresses that.

Benton 1 year ago

This is a tricky one. I'm not sure if the IP-based access control or the HTTPS setup is the right solution here. I think I'll need to dig deeper into the code and understand how the user data is being included before I can decide on the best fix.

Cristal 1 year ago

Okay, I think I've got a plan. I'll use the Web Security Scanner to test for potential XSS attacks in the staging environment, and then implement a templating system that supports contextual auto-escaping to properly sanitize the user input.

Melodie 1 year ago

Hmm, I'm a bit unsure about the best approach here. Should I focus on the network security aspects like the HTTPS load balancer and Cloud Armor, or go straight to the code-level fixes like the templating system?

Sunshine 1 year ago

This looks like a classic XSS vulnerability. I'd start by using a web security scanner to identify the specific areas where user input is being included without proper validation.

An 1 year ago

Hmm, I wonder if the attacker will try to execute a 'git push origin master' command. Better go with option D to be safe!

Oretha 1 year ago

↳ replying to An

Let's also make sure to use a templating system that supports contextual auto-escaping to further secure the web application.

Jules 1 year ago

↳ replying to An

Agreed, using Web Security Scanner to simulate an XSS injection attack in staging is a good idea.

Pearlie 1 year ago

↳ replying to An

I think we should go with option D to prevent any potential XSS attack.

Micheal 1 year ago

This is a classic case of 'garbage in, garbage out.' Option D is the way to go! Gotta love those templating systems with auto-escaping.

Jennie 1 year ago

↳ replying to Micheal

We should also consider using the Web Security Scanner to simulate potential attacks and catch any vulnerabilities early on.

Jose 1 year ago

↳ replying to Micheal

Using a templating system with auto-escaping is crucial in preventing XSS attacks. Let's implement that as soon as possible.

Shaunna 1 year ago

↳ replying to Micheal

I agree, option D is definitely the best choice. We need to make sure our web application is secure.

Valentin 1 year ago

I'm leaning towards option B. Setting up an HTTPS load balancer and using Cloud Armor seems like a robust solution to prevent the potential XSS attack.

Ronna 1 year ago

↳ replying to Valentin

It's important to prioritize security measures like this to keep our web application safe from vulnerabilities.

Tegan 1 year ago

↳ replying to Valentin

I agree, setting up an HTTPS load balancer and using Cloud Armor can definitely help protect against potential attacks.

Starr 1 year ago

↳ replying to Valentin

That sounds like a good idea. Option B seems like a strong choice to prevent XSS attacks.

Alyssa 1 year ago

I believe setting up an HTTPS load balancer and using Cloud Armor is also a good option to prevent XSS attacks.

Tonja 1 year ago

Definitely go with option D! Simulating the attack in the staging environment is the best way to identify and fix the vulnerability before it reaches production.

Alease 1 year ago

↳ replying to Tonja

I think running the Web Security Scanner in staging is a smart move to proactively address any potential security risks.

Susana 1 year ago

↳ replying to Tonja

It's important to catch these vulnerabilities early on in the development process to avoid any security breaches in production.

Rueben 1 year ago

↳ replying to Tonja

Using a templating system with contextual auto-escaping is a good way to ensure user input is properly sanitized.

Huey 1 year ago

↳ replying to Tonja

I agree, option D seems like the most proactive approach to prevent any potential attacks.

Abel 2 years ago

I agree with Suzi, Cloud IAP based on IP address or end-user device attributes can help prevent attacks.

Suzi 2 years ago

I think we should use Cloud IAP to prevent the vulnerability.

Google Professional Cloud Security Engineer Exam - Topic 1 Question 101 Discussion