Which HTTP response header is commonly used to prevent browsers from interpreting files as a different MIME type than the one declared by the server, thereby reducing certain content-based attacks?

Content-Security-Policy: default-src 'self'

Strict-Transport-Security: max-age=31536000

X-Content-Type-Options: nosniff

A DevNet engineer is configuring a Content Security Policy (CSP) for a web application that uses inline event handlers (e.g., onclick) and inline scripts. The security team wants to mitigate XSS, but the application's current design relies heavily on inline code. Which CSP strategy should the engineer recommend to balance security and functionality?

Use a CSP that only allows scripts from the same origin (default-src 'self').

Use a strict CSP with 'nonce' or 'hash' for allowed inline scripts, and refactor inline event handlers to use addEventListener.

Disable CSP entirely and rely on output encoding and input validation.

Use a permissive CSP that allows 'unsafe-inline' for scripts and styles.

A DevNet engineer is reviewing a database access layer that uses stored procedures. The procedures are called with user-supplied parameters. A security audit flags that some procedures are vulnerable to SQL injection. Which action should the engineer take to mitigate the vulnerability?

Review the stored procedures to ensure they use parameterized queries internally, not dynamic SQL with concatenation.

Use a WAF to block requests that contain SQL keywords.

Add input validation to the application layer to reject SQL keywords before calling the stored procedures.

Grant the application's database user only SELECT permissions to limit the impact of injection.

A DevNet engineer is building a web application that displays a user's profile name. The name is stored in a database and rendered in an HTML element. The security team requires mitigation against stored XSS. Which combination of controls should the engineer implement?

Validate the input on the server and apply context-aware output encoding when rendering.

Use a Content Security Policy that disallows all inline scripts.

Validate the input only on the client side using JavaScript.

Store the name in a database field that is marked as 'safe' to skip rendering checks.

CiscoCertified DevNet Professional

Domain 4Objective 10

Implement Mitigation Strategies for OWASP Threats (such as XSS, CSRF, and SQL Injection) 350-901 Practice Questions (Page 3)

Part of the 4.0 Application Deployment and Security domain, which accounts for 20% of the 350-901 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

20%of the exam

Questions 11–15

11foundation · easy
Which HTTP response header is commonly used to prevent browsers from interpreting files as a different MIME type than the one declared by the server, thereby reducing certain content-based attacks?
Select an answer first
12expert · hard
A DevNet engineer is configuring a Content Security Policy (CSP) for a web application that uses inline event handlers (e.g., onclick) and inline scripts. The security team wants to mitigate XSS, but the application's current design relies heavily on inline code. Which CSP strategy should the engineer recommend to balance security and functionality?
Select an answer first
13expert · hard
A DevNet engineer is reviewing a database access layer that uses stored procedures. The procedures are called with user-supplied parameters. A security audit flags that some procedures are vulnerable to SQL injection. Which action should the engineer take to mitigate the vulnerability?
Select an answer first
14foundation · easy
A web application uses cookies for session management. To reduce the risk of cross-site request forgery (CSRF) attacks, which cookie attribute should be set so that the browser only sends the cookie on same-site requests?
Select an answer first
15application · medium
A DevNet engineer is building a web application that displays a user's profile name. The name is stored in a database and rendered in an HTML element. The security team requires mitigation against stored XSS. Which combination of controls should the engineer implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-901

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-901” is a trademark of its owner, used for identification only.

Implement Mitigation Strategies for OWASP Threats (such as XSS, CSRF, and SQL Injection) 350-901 Practice Questions (Page 3)

Questions 11–15

Which HTTP response header is commonly used to prevent browsers from interpreting files as a different MIME type than the one declared by the server, thereby reducing certain content-based attacks?

A DevNet engineer is reviewing a database access layer that uses stored procedures. The procedures are called with user-supplied parameters. A security audit flags that some procedures are vulnerable to SQL injection. Which action should the engineer take to mitigate the vulnerability?

A web application uses cookies for session management. To reduce the risk of cross-site request forgery (CSRF) attacks, which cookie attribute should be set so that the browser only sends the cookie on same-site requests?

A DevNet engineer is building a web application that displays a user's profile name. The name is stored in a database and rendered in an HTML element. The security team requires mitigation against stored XSS. Which combination of controls should the engineer implement?

Keep studying — 4.0 Application Deployment and Security