Secure Coding Practices for Input Validation in Java CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   A Java application uses a regex to validate a user's phone number. The regex is currently compiled every time it is used. The team wants to improve performance and security. What should they do?

   • AUse a blacklist to remove invalid characters instead of a regex.
   • BUse a custom parser to validate the phone number instead of a regex.
   • CUse String.matches() which compiles the regex each time, but it is simpler.
   • DCompile the regex once as a static final Pattern and reuse it.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Java application allows users to specify a file path to download a file from the server. The team wants to prevent directory traversal attacks. Which validation should be applied to the file path?

   • AEncode the file path using URL encoding before using it to access the file.
   • BUse a blacklist to remove common traversal sequences like ../ and ..\ from the file path.
   • CUse a whitelist that allows only alphanumeric characters and a single dot for the file extension.
   • DResolve the file path to its canonical form and verify that it starts with the intended base directory.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How can code reviews help improve input validation in a Java project?

   • ABy replacing the need for automated testing
   • BBy automatically fixing all validation bugs
   • CBy identifying missing or incorrect validation logic before the code is deployed
   • DBy ensuring that validation is only applied to user input from the internet
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Java web application accepts a user-supplied 'username' field that is later used in a database query. The security team mandates that only alphanumeric characters and underscores are allowed. Which validation approach is most appropriate?

   • AAccept the input if it matches the regex ^[a-zA-Z0-9_]+$.
   • BUse a blacklist that blocks common SQL keywords like SELECT, INSERT, and DROP.
   • CEscape the input before using it in the query and accept any characters.
   • DReject any input that contains characters from a known list of SQL metacharacters (e.g., ', ;, --).
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which Java specification provides annotations like @NotNull and @Size for declarative input validation?

   • ABean Validation (javax.validation)
   • BJava Database Connectivity (JDBC)
   • CJava Naming and Directory Interface (JNDI)
   • DJava Persistence API (JPA)
   Reveal Solution Discussion Select an answer first