2.3Standard
Display AI answers on a web page and turn some text into links.
Generated HTML or URLs must not execute.
Choose two controls.
× Incorrect
Escape output, limit URL schemes, domains, and elements, validate structure, and separate display from executable operations.
Detailed explanation
CorrectHTML-escape output and restrict allowed URL schemes, domains, and elements
XSS and unsafe links are reduced.
IncorrectTrust model instructions and insert output into the DOM unchanged
Output can contain attacker-controlled text.
IncorrectAllow every script to make links work
The attack surface expands.
CorrectValidate structured output and separate display from executable processing
Generated text does not become code automatically.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 2.3・5.1の出力検証、Web安全、Guardrailsを確認する。
Official references
What to confirm
生成結果をHTML・URL・コードへ無加工で渡さない境界を説明できる。
Key points
- Escaping
- Schema
- XSS
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Output injection
An attack in which generated content is interpreted as HTML, script, SQL, or a command.
Output escaping
Encoding special characters so a destination interpreter treats them as data rather than syntax.
Question IDAWS-AIF-279
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue