Secure Coding Practices for Input Validation in Java CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a direct consequence of failing to validate input in a Java web application?

   • AThe application may become vulnerable to injection attacks such as SQL injection
   • BThe application will be immune to cross-site scripting
   • CThe application will always run slower
   • DThe application will automatically log all user actions
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A development team is adopting a secure coding standard for input validation. They want to ensure that all input is validated at the trust boundary. Which practice should they follow?

   • AValidate input at every layer of the application, including the presentation, business, and data access layers.
   • BValidate input only in the presentation layer to keep the business logic clean.
   • CValidate input only when it is first received from the user and then trust it for the rest of the application.
   • DValidate input only in the data access layer to ensure that only safe data reaches the database.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A development team is integrating input validation into their CI/CD pipeline. They want to automatically detect missing validation for common injection points. Which tool is most appropriate?

   • AA static application security testing (SAST) tool.
   • BA web application firewall (WAF).
   • CA manual code review only.
   • DA runtime application self-protection (RASP) tool.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Java application processes JSON input from a REST API. The team wants to ensure that malformed JSON does not cause the application to crash or expose internal details. What should they implement?

   • ALet the JSON parsing exception propagate to the container so it returns a 500 error.
   • BWrap the JSON parsing in a try-catch block, log the error, and return a generic 400 Bad Request response.
   • CValidate the JSON schema before parsing to ensure it is well-formed.
   • DReturn the exception message to the client so they can fix the JSON.
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A Java application accepts a 'role' parameter that is used to assign permissions. The valid roles are 'admin', 'user', and 'guest'. The application currently uses a blacklist to reject 'admin' from user input. What is the most secure approach?

   • AUse a prepared statement to prevent SQL injection in the role assignment.
   • BUse a whitelist that only allows 'user' and 'guest'.
   • CContinue using the blacklist and add more forbidden roles.
   • DEscape the role parameter before using it.
   Reveal Solution Discussion Select an answer first