Which of the following would an attacker exploit by using externally injected script that leads...

Cross-site scripting, or XSS, is the correct answer because it involves injecting malicious script into web content that executes in a user’s browser. If an application fails to validate or encode input properly, an attacker can cause the browser to run externally supplied JavaScript. This can allow session theft, credential harvesting, browser redirection, page manipulation, or actions performed as the victim. A secure web gateway, or SWG, is a defensive control, not an attack vulnerability. Denial of service focuses on disrupting availability, not controlling a browser through script execution. SQL injection targets backend database queries rather than browser-side script execution. The phrase “externally injected script” strongly identifies XSS as the exploited vulnerability.