The hacker's next step to confirm the XSS vulnerability would be to utilize a script hosted on the application' s domain to test the form. This is because the application's CSP allows scripts from its own domain, but not from inline or external sources. Therefore, the hacker can try to inject a payload that references a script file on the same domain as the application, such as:
<script src="/path/to/script.js"></script>
where script.js contains some benign code, such as alert('XSS') or print('XSS'). If the script executes in the browser, then the hacker has confirmed the XSS vulnerability. Otherwise, the CSP has blocked the script and prevented the XSS attack.
The other options are not feasible or effective for the following reasons:
* A. Try to disable the CSP to bypass script restrictions: This option is not feasible because the hacker cannot disable the CSP on the server side, and the browser enforces the CSP on the client side. The hacker would need to modify the browser settings or use a browser extension to disable the CSP, but this would not affect the victim's browser or the application's security.
* B. Inject a benign script inline to the form to see if it executes: This option is not effective because the application's CSP disallows inline scripts, meaning scripts that are embedded in the HTML code.
Therefore, the hacker would not be able to inject a script tag or an event handler attribute that contains some code, such as:
<script>alert('XSS')</script> or <input type="text" onfocus="alert('XSS')"> The CSP would block these scripts and prevent the XSS attack.
* D. Load a script from an external domain to test the vulnerability: This option is not effective because the application's CSP disallows scripts from external domains, meaning scripts that are loaded from a different domain than the application. Therefore, the hacker would not be able to inject a script tag that references a script file on another domain, such as:
<script src="https://example.com/script.js"></script>
The CSP would block these scripts and prevent the XSS attack.
References:
* 1: Content Security Policy (CSP) - HTTP | MDN
* 2: What is Content Security Policy (CSP) | Header Examples | Imperva
* 3: Content-Security-Policy (CSP) Header Quick Reference
* 4: What is cross-site scripting (XSS)? - PortSwigger
* 5: Cross Site Scripting (XSS) | OWASP Foundation
* 6: The Impact of Cross-Site Scripting Vulnerabilities and their Prevention
* 7: XSS Vulnerability 101: Identify and Stop Cross-Site Scripting

The correct answer is B. True Positive.
A true positive occurs when a security control correctly identifies malicious or unauthorized activity as malicious. In this scenario, the red team exploit was real within the authorized test scope, the IDS generated an alert, and log correlation confirmed that the alert matched the exploit traffic.
CEH-aligned IDS material explains that a false positive occurs when an IDS alerts on traffic as malicious when it is not, while a false negative occurs when the IDS fails to alert even though an intrusion attempt occurred . By contrast, this case is neither false positive nor false negative because the alert was accurate and corresponded to actual exploit activity.
Option A. False Negative is incorrect because the IDS did not miss the attack.
Option C. False Positive is incorrect because the alert was not triggered by benign traffic.
Option D. True Negative is incorrect because a true negative means no attack occurred and no alert was generated.
Therefore, the best answer is B. True Positive.

Telnet is insecure by default because it transmits data, including usernames and passwords, in plaintext without encryption, making it vulnerable to interception and sniffing attacks.

Unlimited login attempts significantly increase the feasibility of password-guessing attacks.
Implementing account lockout, progressive delays, CAPTCHA, or rate limiting helps reduce automated authentication attacks. Generic error messages prevent user enumeration but do not mitigate repeated login attempts against valid accounts.