An application's AJAX endpoint `/api/search` accepts a `callback` parameter and returns JSONP responses. A security review warns that an attacker could use the endpoint to exfiltrate data. Which change is the MOST secure way to eliminate the JSONP risk while preserving the endpoint's functionality for same-origin AJAX calls?

Remove JSONP support and require the frontend to use the `fetch` API with `credentials: 'same-origin'`.

Add a CSRF token to the JSONP request.

Validate the `callback` parameter against a strict allowlist of alphanumeric characters.

Set the `Content-Type` header to `application/json` instead of `application/javascript`.

A web application uses AJAX to load user comments and inserts them into the page using `document.getElementById('comments').innerHTML = data`. A security review flagged this as vulnerable to XSS. Which client-side change is the most secure replacement?

Use `textContent` to insert the comment text, and create elements for any links using `document.createElement` and `setAttribute`.

Use `eval` to parse the JSON and then render.

Use `insertAdjacentHTML` with a whitelist of allowed tags.

Use `innerHTML` but sanitize the data with a client-side sanitizer library.

A single-page application renders user-supplied comments fetched via AJAX and inserts them into the DOM using `innerHTML`. A penetration test reveals a stored XSS vulnerability. The team wants a defense-in-depth approach that includes both preventing the XSS and limiting the impact if it occurs. Which combination of controls is MOST appropriate?

Encode the output on the server side but continue using `innerHTML` without a CSP.

Use `textContent` instead of `innerHTML` and add a strict Content Security Policy that disallows inline scripts.

Disable JavaScript entirely for the page that displays comments.

Sanitize the input on the client side with a regex that removes ` ` tags and keep `innerHTML`.

GIAC Certified Web Application Defender

Domain 4Objective 1

AJAX Technologies and Security Strategies GWEB Practice Questions (Page 6)

Part of the Advanced Threats and Defense domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 5–8 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 26–30

26application · medium
An application's AJAX endpoint `/api/search` accepts a `callback` parameter and returns JSONP responses. A security review warns that an attacker could use the endpoint to exfiltrate data. Which change is the MOST secure way to eliminate the JSONP risk while preserving the endpoint's functionality for same-origin AJAX calls?
Select an answer first
27application · medium
A web application uses AJAX to load user comments and inserts them into the page using `document.getElementById('comments').innerHTML = data`. A security review flagged this as vulnerable to XSS. Which client-side change is the most secure replacement?
Select an answer first
28application · medium
A single-page application renders user-supplied comments fetched via AJAX and inserts them into the DOM using `innerHTML`. A penetration test reveals a stored XSS vulnerability. The team wants a defense-in-depth approach that includes both preventing the XSS and limiting the impact if it occurs. Which combination of controls is MOST appropriate?
Select an answer first
29application · medium
A development team is building a single-page application that renders user-generated content returned from AJAX responses. The content is inserted into the DOM using `innerHTML`. The security team has mandated a Content Security Policy (CSP) to mitigate XSS. Which CSP directive is most effective in preventing the execution of injected script tags?
Select an answer first
30foundation · easy
Which protocol is essential to ensure that AJAX communications are encrypted and protected from interception?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

AJAX Technologies and Security Strategies GWEB Practice Questions (Page 6)

Questions 26–30

A web application uses AJAX to load user comments and inserts them into the page using `document.getElementById('comments').innerHTML = data`. A security review flagged this as vulnerable to XSS. Which client-side change is the most secure replacement?

Which protocol is essential to ensure that AJAX communications are encrypted and protected from interception?

Keep studying — Advanced Threats and Defense