Input Validation Approaches and Filtering CASENET Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of output encoding in the context of input validation?

   • ATo validate that input matches a predefined pattern
   • BTo neutralize dangerous characters before they are interpreted by the target context
   • CTo convert input to a canonical form
   • DTo remove all non-alphanumeric characters from input
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A .NET application has a form field for a US ZIP code. The team needs to validate the input. Which validation approach is most appropriate?

   • AUse a whitelist regular expression that matches exactly five digits or ZIP+4 format.
   • BUse client-side validation only, since ZIP codes are simple.
   • CUse a blacklist to reject input containing the characters <, >, and '.
   • DUse a length check to ensure the input is 5 or 10 characters long.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is server-side validation essential even when client-side validation is implemented?

   • AClient-side validation is too slow for production use.
   • BServer-side validation is required to improve user experience.
   • CClient-side validation only works with HTTPS.
   • DClient-side validation can be bypassed by an attacker who disables JavaScript or crafts custom requests.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A .NET application has a dropdown list of country codes (e.g., US, CA, MX). The selected value is posted to the server. What is the best way to validate the posted value?

   • ACheck that the posted value exists in a server-side allowlist of valid country codes.
   • BUse a regular expression to match any two-letter uppercase string.
   • CTrust the posted value because it came from a dropdown list.
   • DUse a blacklist to reject any value that is not a known country code.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A .NET web application accepts a product code from a query string and uses it to look up a record in a database. The product code must be exactly 8 characters: 3 uppercase letters followed by 5 digits. The developer wants to enforce this with minimal code and prevent SQL injection. What is the most appropriate validation approach?

   • AUse a regular expression to match the pattern ^[A-Z]{3}[0-9]{5}$ and reject any input that does not match.
   • BConvert the input to an integer using int.Parse() and then use it in the query.
   • CUse a blacklist to remove common SQL injection strings such as ' OR 1=1 -- from the input before using it.
   • DCheck that the input length is exactly 8 characters and then use it directly in the SQL query.
   Reveal Solution Discussion Select an answer first