Secure Coding Practices for Input Validation in Java CASEJAVA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In input validation, what is the key difference between whitelist and blacklist approaches?

   • AWhitelist is less secure than blacklist
   • BWhitelist is used only for numeric input; blacklist is used for text input
   • CWhitelist is faster than blacklist in all cases
   • DWhitelist defines what is allowed; blacklist defines what is forbidden
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A Java web application has a search feature that accepts a 'q' parameter. The search is performed against a database using a LIKE query. The team wants to prevent SQL injection while allowing users to search for any text. Which approach is most appropriate?

   • AUse a whitelist that only allows alphanumeric characters.
   • BUse a prepared statement with the search term as a bound parameter.
   • CEscape single quotes in the input and concatenate it into the query.
   • DUse a blacklist to remove SQL keywords from the input.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   When validating input that will be embedded in HTML output, what is the primary security concern?

   • APreventing cross-site scripting (XSS) attacks
   • BPreventing denial of service
   • CPreventing buffer overflows
   • DPreventing SQL injection
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A Java application accepts a username from a registration form. The business rule states that usernames must be 3–20 characters long and contain only letters, digits, and underscores. The security team wants to ensure that the validation is robust and cannot be bypassed by Unicode lookalikes or encoded input. Which validation approach should be used?

   • AUse a whitelist regex with the Pattern class and the UNICODE_CHARACTER_CLASS flag, and reject any input that does not match.
   • BConvert the input to HTML entities before validation, then check the length and allowed characters.
   • CUse the String.matches() method with the regex [a-zA-Z0-9_]{3,20} and accept the input if it matches.
   • DUse a blacklist that removes common special characters like <, >, ', and "; then check the length.
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A Java web application uses a custom validation framework. The team wants to ensure that validation errors are handled consistently and do not leak internal details. Which approach is best?

   • AUse a global exception handler that maps validation exceptions to user-friendly messages and logs the details internally.
   • BLog the exception and rethrow it to the caller.
   • CReturn the exception message directly to the user.
   • DCatch all exceptions and return a generic error message.
   Reveal Solution Discussion Select an answer first