Input Validation Approaches and Filtering CASENET Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which input validation strategy is most likely to be bypassed by novel or unexpected attack patterns?

   • AAllowlist validation
   • BBlacklist validation
   • CWhitelist validation
   • DCanonicalization
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An API endpoint accepts a 'dateOfBirth' field as a string. The application needs to store the date in a database. The developer wants to reject invalid dates and prevent format-based attacks. What is the most appropriate validation?

   • AUse DateTime.TryParseExact() with a specific format and culture, and reject if parsing fails.
   • BUse DateTime.TryParse() with the current culture and accept any parseable date.
   • CCheck that the string length is 10 characters and then store it as a string.
   • DUse a regular expression to match ^\d{4}-\d{2}-\d{2}$ and store the string.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A development team is building a public-facing ASP.NET Core application. They want to use client-side validation for immediate user feedback and server-side validation for security. However, they are concerned about performance and user experience. What is the best practice?

   • AImplement only client-side validation to reduce server load and improve response time.
   • BImplement client-side validation and rely on HTTPS to protect the data in transit.
   • CImplement both client-side and server-side validation, but ensure the server-side validation is the authoritative security control.
   • DImplement only server-side validation because client-side validation is never useful.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An ASP.NET application has a textarea where users can enter a biography. The application later displays this biography in an HTML page. The developer wants to prevent XSS while preserving the user's original text as much as possible. What is the best approach?

   • AStrip all HTML tags from the input before storing it.
   • BHTML-encode the biography when rendering it in the view.
   • CStore the input in a database column with nvarchar(max) and rely on the database to sanitize it.
   • DUse HttpUtility.UrlEncode() on the input before storing it.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A .NET application accepts a username that is later used in a log file. The team wants to prevent log injection by sanitizing the input. What is the most effective filtering technique?

   • AUse URL encoding on the username before logging.
   • BUse a blacklist to reject usernames containing the word 'admin'.
   • CUse HTML encoding on the username before logging.
   • DEncode or remove carriage return and line feed characters from the input.
   Reveal Solution Discussion Select an answer first