Input Validation Approaches and Filtering CASENET Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is it important to validate the data type of user input?

   • ATo ensure the input is stored in the correct database column
   • BTo prevent type confusion attacks and ensure the input is used correctly by the application
   • CTo reduce the amount of code needed for validation
   • DTo improve the speed of validation
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A .NET MVC application has a registration form with client-side validation for email format, password length, and required fields. The security team insists that the server must also validate all inputs. Which statement best justifies this requirement?

   • AClient-side validation is unreliable because JavaScript is not supported by all browsers.
   • BClient-side validation improves user experience but can be bypassed by an attacker who sends crafted HTTP requests directly to the server.
   • CServer-side validation is required only when the application uses HTTPS.
   • DClient-side validation is slower than server-side validation, so the server must handle all validation for performance.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A .NET application accepts a 'role' field from a form. The valid roles are 'Admin', 'User', and 'Guest'. The current code uses a blacklist to reject the value 'Admin' because it is considered dangerous. What is the most secure way to handle this field?

   • ACheck that the role string length is between 3 and 10 characters.
   • BConvert the role to an integer and use that in the application logic.
   • CUse a whitelist that only accepts the exact strings 'Admin', 'User', or 'Guest'.
   • DUse a blacklist that rejects 'Admin' and any other dangerous role names.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A developer is building a feature that exports user data to a CSV file. The data includes user-supplied fields that may contain commas, quotes, and newlines. What is the most important step to prevent CSV injection?

   • AStore the CSV file in a protected directory and rely on access controls.
   • BEscape or encode the user-supplied fields according to CSV formatting rules before writing them to the file.
   • CUse HTML encoding on the fields before writing them to the CSV.
   • DRemove all commas and quotes from the user-supplied fields before writing them.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A team is building an ASP.NET MVC form that collects a user's name and email address. The front-end uses jQuery validation to ensure the email format is correct and the name is not empty. The back-end currently does not validate these fields. What is the most important security improvement to make?

   • AUse a blacklist to remove any characters that are not letters or numbers from the input.
   • BRely on the client-side validation because it provides immediate feedback and reduces server load.
   • CAdd server-side validation that enforces the same rules and rejects invalid input before processing.
   • DEncode the input with HTML encoding before storing it in the database.
   Reveal Solution Discussion Select an answer first