During a penetration test, a tester finds that the web application being analyzed is vulnerable to Cross Site
Scripting (XSS). Which of the following conditions must be met to exploit this vulnerability?

A.
The web application does not have the secure flag set.

B.
The session cookies do not have the HttpOnly flag set.

C.
The victim user should not have an endpoint security solution.

D.
The victim’s browser must have ActiveX technology enabled.