A .NET application accepts a file path from user input to retrieve a file from a local directory. Security testing revealed that an attacker can use encoded traversal sequences like %2e%2e%2f to escape the intended directory. The team wants to prevent this while still allowing legitimate relative paths. What should be done first?

Replace all occurrences of '..' with an empty string in the input.

Decode the input using System.Uri.UnescapeDataString and then normalize the path with Path.GetFullPath before validating it.

Validate the input against a whitelist of allowed file names before decoding.

Use a regular expression to reject any input containing a dot character.

A .NET application has a feature that exports user data to a CSV file. The user can control some of the data that is written to the CSV. The team wants to prevent CSV injection, where a value starting with '=', '+', '-', or '@' is interpreted as a formula by spreadsheet software. What is the most effective mitigation?

Use HTML encoding on all values before writing to the CSV.

Prefix any cell value that starts with a dangerous character with a single quote (') before writing to the CSV.

Use URL encoding on all values before writing to the CSV.

Use a blacklist to reject any input containing '=', '+', '-', or '@'.

A developer is implementing a search feature that accepts a query string and uses it in a LIKE clause in SQL. The developer wants to prevent SQL injection while allowing users to search for partial matches. What is the most appropriate approach?

Use a parameterized query with the search term as a parameter, and escape any LIKE wildcards in the input.

Use a blacklist to remove common SQL keywords and then concatenate the input into the query.

Use a regular expression to allow only letters and numbers, and then concatenate the input.

Encode the input using HTML encoding and then concatenate it into the query.

Which of the following is an example of canonicalization to prevent path traversal?

Encoding the input as HTML entities

Removing all characters that are not alphanumeric

Rejecting input that contains the string '..'

Converting '..\' to its canonical path equivalent before validation

EC-CouncilCertified Application Security Engineer (.NET)

Domain 3Objective 1

Input Validation Approaches and Filtering CASENET Practice Questions (Page 6)

Part of the Secure Coding: Input Validation domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 2–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 26–30

26application · medium
A .NET application accepts a file path from user input to retrieve a file from a local directory. Security testing revealed that an attacker can use encoded traversal sequences like %2e%2e%2f to escape the intended directory. The team wants to prevent this while still allowing legitimate relative paths. What should be done first?
Select an answer first
27expert · hard
A .NET application has a feature that exports user data to a CSV file. The user can control some of the data that is written to the CSV. The team wants to prevent CSV injection, where a value starting with '=', '+', '-', or '@' is interpreted as a formula by spreadsheet software. What is the most effective mitigation?
Select an answer first
28expert · hard
A developer is implementing a search feature that accepts a query string and uses it in a LIKE clause in SQL. The developer wants to prevent SQL injection while allowing users to search for partial matches. What is the most appropriate approach?
Select an answer first
29foundation · easy
Which of the following is an example of canonicalization to prevent path traversal?
Select an answer first
30foundation · easy
Which filtering technique would you use to strip out all non-alphanumeric characters from a username field?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Input Validation Approaches and Filtering CASENET Practice Questions (Page 6)

Questions 26–30

A developer is implementing a search feature that accepts a query string and uses it in a LIKE clause in SQL. The developer wants to prevent SQL injection while allowing users to search for partial matches. What is the most appropriate approach?

Which of the following is an example of canonicalization to prevent path traversal?

Which filtering technique would you use to strip out all non-alphanumeric characters from a username field?

Keep studying — Secure Coding: Input Validation