A web developer at a company is reviewing a customer feedback form that displays submitted comments on a public page. A tester submits the comment alert('x') and the script executes for every visitor. Which mitigation should the developer apply to prevent this attack while preserving the intended formatting of legitimate comments?

Add a CSRF token to the feedback form and validate it on the server

Set the HttpOnly flag on all session cookies

Encode all user-supplied content on output and use a strict allowlist for any permitted HTML tags

Use a parameterized query when inserting the comment into the database

Which mitigation is specifically designed to prevent CSRF attacks?

Using input validation to reject special characters

Encoding all user output with HTML entities

Restricting database permissions to read-only

Using a CSRF token that is validated on the server for each state-changing request

A web application allows users to post comments that are displayed to other users. The development team wants to prevent stored XSS attacks. Which combination of controls should they implement?

Using a WAF and relying on it to block all XSS payloads

Encoding input before storing it in the database

Client-side JavaScript validation and disabling JavaScript in the browser

Input validation on the server and output encoding when rendering comments

A network automation platform uses a legacy database query builder that concatenates user input into SQL. The team must remediate SQL injection but cannot refactor the entire application to an ORM. They are evaluating: (A) a global input-validation filter that rejects any input containing SQL keywords, (B) a database-level firewall that blocks suspicious queries, (C) a custom escaping function that escapes single quotes in all inputs, (D) a prepared-statement wrapper for the query builder. Which option is the most robust and practical mitigation?

Option B: A database-level firewall that blocks suspicious queries

Option A: A global input-validation filter that rejects SQL keywords

Option C: A custom escaping function that escapes single quotes

Option D: A prepared-statement wrapper for the query builder

A security team is performing a risk assessment of a web application. They have identified the following vulnerabilities: (1) SQL injection in a login form, (2) stored XSS in a user profile field, (3) CSRF on a password change form, and (4) verbose error messages that reveal database schema. The application is internet-facing and handles financial data. Which vulnerability should be remediated first?

SQL injection in the login form

Stored XSS in the user profile field

CSRF on the password change form

CiscoCertified Network Associate Automation (CCNA Automation)

Domain 4Objective 10

10. Describe Top OWASP Threats (such as XSS, SQL Injections, and CSRF) 200-901 Practice Questions (Page 1)

Part of the 4.0 Application Deployment and Security domain, which accounts for 15% of the 200-901 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

5concepts

15%of the exam

Questions 1–5

1application · medium
A web developer at a company is reviewing a customer feedback form that displays submitted comments on a public page. A tester submits the comment <script>alert('x')</script> and the script executes for every visitor. Which mitigation should the developer apply to prevent this attack while preserving the intended formatting of legitimate comments?
Select an answer first
2foundation · easy
Which mitigation is specifically designed to prevent CSRF attacks?
Select an answer first
3application · medium
A web application allows users to post comments that are displayed to other users. The development team wants to prevent stored XSS attacks. Which combination of controls should they implement?
Select an answer first
4expert · hard
A network automation platform uses a legacy database query builder that concatenates user input into SQL. The team must remediate SQL injection but cannot refactor the entire application to an ORM. They are evaluating: (A) a global input-validation filter that rejects any input containing SQL keywords, (B) a database-level firewall that blocks suspicious queries, (C) a custom escaping function that escapes single quotes in all inputs, (D) a prepared-statement wrapper for the query builder. Which option is the most robust and practical mitigation?
Select an answer first
5expert · hard
A security team is performing a risk assessment of a web application. They have identified the following vulnerabilities: (1) SQL injection in a login form, (2) stored XSS in a user profile field, (3) CSRF on a password change form, and (4) verbose error messages that reveal database schema. The application is internet-facing and handles financial data. Which vulnerability should be remediated first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-901

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-901” is a trademark of its owner, used for identification only.

10. Describe Top OWASP Threats (such as XSS, SQL Injections, and CSRF) 200-901 Practice Questions (Page 1)

Questions 1–5

Which mitigation is specifically designed to prevent CSRF attacks?

A web application allows users to post comments that are displayed to other users. The development team wants to prevent stored XSS attacks. Which combination of controls should they implement?

Keep studying — 4.0 Application Deployment and Security