Which technique is an example of input validation?

Using a blacklist to block known bad words

Checking that an email address contains an @ symbol

Disabling JavaScript in the browser

What is a modern sanitization function used to prevent XSS?

Using a library like DOMPurify to clean HTML

Using the alert() function to test input

Using the innerHTML property to insert input directly

Using the eval() function to process input

A web application allows users to upload images. The security team wants to neutralize any malicious code that might be embedded in the image files. Which technique should be used?

Re-encode the uploaded image using a trusted image processing library.

Store the image in a separate domain to isolate it from the main application.

Set the image's 'Content-Disposition' header to 'attachment'.

Validate the file extension and Content-Type header.

A web application allows users to search for products by name. The current implementation concatenates the user's search term directly into a SQL query. After a security review, the team decides to use prepared statements. What is the primary security benefit of this change?

Prepared statements separate the SQL logic from the data, so user input cannot alter the query structure.

Prepared statements automatically encrypt all data transmitted between the application and the database.

Prepared statements store the query in the database, making it impossible for attackers to modify it.

Prepared statements validate that user input contains only alphanumeric characters.

What is the goal of input sanitization for XSS prevention?

To log all user input for later analysis

To encrypt user input before storing it

To compress user input to save space

To remove or neutralize malicious scripts from user input

CertNexusCyberSec First Responder (CFR)

Domain 3Objective 3

Objective 3.3 Protect Software. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 8)

Part of the 3.0 Address the Security Concerns of Computing Environments domain, which accounts for 28% of the CYBERSEC-FIRST-RESPONDER exam.

53questions here

11free pages

18concepts

28%of the exam

18 Concepts in This Objective

Patching
Assessment and testing of updates
Static code analysis
Dynamic software analysis
Secure coding practices
Static queries
Prepared statements and parameterized queries
Stored procedures
Input validation
Input sanitization for XSS
Modern sanitization functions
Consistent application of sanitization
Anti-CSRF tokens
Server-side checking of tokens
Validation of file extensions
Validation of Content-Type headers
Scrubbing of metadata
Re-encoding of uploaded files

Questions 36–40

36foundation · easy
Which technique is an example of input validation?
Select an answer first
37foundation · easy
What is a modern sanitization function used to prevent XSS?
Select an answer first
38application · medium
A web application allows users to upload images. The security team wants to neutralize any malicious code that might be embedded in the image files. Which technique should be used?
Select an answer first
39application · medium
A web application allows users to search for products by name. The current implementation concatenates the user's search term directly into a SQL query. After a security review, the team decides to use prepared statements. What is the primary security benefit of this change?
Select an answer first
40foundation · easy
What is the goal of input sanitization for XSS prevention?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSEC-FIRST-RESPONDER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CYBERSEC-FIRST-RESPONDER” is a trademark of its owner, used for identification only.