Markup and Web Languages

Auto Generate HTML feature is NOT enabled by default in Pega. This feature automatically generates HTML for properties and must be explicitly enabled when needed. The default setting is False to provide developers control over HTML generation and prevent unintended rendering behavior.

HTML Fragments in Pega (Rule-HTML-Fragment) are indeed rules that are associated with and dependent on a specific class. Therefore, saying they are dependent on a class is true, meaning the false statement assertion is correct.

JSON (JavaScript Object Notation) is a subset of JavaScript's object literal syntax. Despite the name, JSON is language-independent and can be parsed and generated by virtually any modern programming language.

Cross-site scripting (XSS) attacks have three main types: Persistent (stored), Reflected (non-stored), and DOM-based. Option D 'Inflicted' is NOT a recognized XSS attack type - this is the correct 'not valid' answer. Options A, B, C are all valid XSS attack types, so they are incorrect answers to this negative-framed question.

Input validation should be as comprehensive as possible, validating the type, length, format, and range of data to prevent injection attacks like XSS. Validating only a subset of these properties (such as just type and format) leaves gaps that attackers can exploit.

To improve the overall quality of web applications, developers should abide by the following rule:

B. Clean and validate all user input.

Explanation:

Option A: Trusting user-supplied data is not a good practice, as it can lead to security vulnerabilities such as injection attacks, cross-site scripting (XSS), and cross-site request forgery (CSRF).

Option B: Clean and validate all user input is a good practice that can help prevent security vulnerabilities. Input validation can help ensure that the data is in the correct format and meets the expected criteria, while input cleaning can help remove any malicious content from the user input.

Option C: Using GET instead of POST is not a rule for improving the overall quality of web applications. GET and POST are different HTTP methods used in web applications, and each has its own advantages and disadvantages. Choosing the right method depends on the requirements of the application.

Option D: Allowing the use of HIDDEN form fields is not a rule for improving the overall quality of web applications. HIDDEN form fields can be used to store data that the user cannot see or modify, but they do not provide any security benefits.

Therefore, the correct answer is:

The Answer is: B. Clean and validate all user input.

Browsers automatically include cookies for the domain in HTTP requests, including POST form submissions. This is how session state is maintained - the session ID cookie travels with the form POST to the server, allowing the server to associate the submission with the authenticated session.

To read XML documents, the query language used is XPath.

Option A is correct because XPath is a query language used to navigate and select elements and attributes in an XML document. It provides a syntax for addressing specific parts of an XML document, similar to how directories and files are addressed in a file system.

Option B, XmlReader, is incorrect because XmlReader is a .NET class used to read XML documents, but it is not a query language. It provides a way to read XML data sequentially and extract information from it.

Option C, SQL, is incorrect because SQL is a query language used to interact with relational databases, not XML documents.

Option D, xmlPlus, is incorrect because there is no such query language with that name for reading XML documents.

Therefore, the answer is: A. XPath

Cross-Site Scripting (XSS) attacks work by injecting malicious scripts into web pages that other users view. When a vulnerable site echoes client-supplied data without proper sanitization, that data executes in the context of the victim's browser session, allowing attackers to steal cookies, session tokens, or perform actions on behalf of the victim.

This language is an XML format that describes the interface to web services, including the data format.

This language is a standard for describing structured data used by InfoPath and many other tools.

There can be multiple web.config file in multiple directories on an ASP.NET Web application server. Each Web.config file applies configuration settings to its own directory and all child directories.

The users attribute in web.config allows two wild card characters: * and ?. Anonymous users are identified using a question mark (?). We can specify all authenticated users using an asterisk (*).

The tt tag is used for displaying teletype of monospaced text. It is not related to the designing of a table.

A Web browser like Internet explorer, Chrome or FireFox can interpret the set of HTML tags within the page in order to display the page on the screen as the page's creator intended it to be viewed. It recieves the HTML tags from the server, reads it and renders or creates the page on the client system accordingly.