A .NET web application uses ASP.NET MVC with data annotations for model validation. The team wants to ensure that validation is enforced on the server. What is the best way to do this?

Use a custom filter that automatically validates the model without any code in the controller.

Call ModelState.IsValid in the controller action before processing the model.

Use JavaScript to validate the model on the client and submit only if valid.

Rely on the browser's built-in HTML5 validation attributes.

A .NET application allows users to upload files to a specific directory. The filename is taken from the user and used to construct the full path. The team wants to prevent path traversal while allowing legitimate filenames like 'report_v1.txt'. Which approach is most secure?

Use a blacklist to reject filenames containing '..' or '/'.

Use Path.GetFullPath on the combined path and verify it starts with the intended directory.

Use Path.Combine and trust that it will prevent traversal.

Use a regular expression to allow only filenames matching ^[a-zA-Z0-9_]+\.[a-zA-Z0-9]+$.

An ASP.NET Core Razor Pages application displays user-generated comments on a community forum. The development team wants to prevent stored XSS attacks while still allowing users to include basic formatting like bold text. What should they do?

Remove all ' ' characters from the comment before storing it.

Store the comment as base64-encoded text and decode it when rendering.

Use JavaScript's encodeURIComponent() on the comment text before storing it in the database.

Use HtmlEncoder.Encode() on the comment text before rendering it in the Razor view.

Which of the following is a limitation of blacklist validation?

It requires canonicalization before validation to be effective.

It is difficult to implement because it requires defining all allowed patterns.

It can be bypassed by novel or obfuscated attack patterns that are not on the list.

It rejects too much valid input because it only allows a narrow set of patterns.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 3Objective 1

Input Validation Approaches and Filtering CASENET Practice Questions (Page 9)

Part of the Secure Coding: Input Validation domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 2–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 41–45

41application · medium
A .NET web application uses ASP.NET MVC with data annotations for model validation. The team wants to ensure that validation is enforced on the server. What is the best way to do this?
Select an answer first
42expert · hard
A .NET application allows users to upload files to a specific directory. The filename is taken from the user and used to construct the full path. The team wants to prevent path traversal while allowing legitimate filenames like 'report_v1.txt'. Which approach is most secure?
Select an answer first
43application · medium
An ASP.NET Core Razor Pages application displays user-generated comments on a community forum. The development team wants to prevent stored XSS attacks while still allowing users to include basic formatting like bold text. What should they do?
Select an answer first
44foundation · easy
Which of the following is a limitation of blacklist validation?
Select an answer first
45foundation · easy
Which filtering technique replaces dangerous characters with a safe representation, such as converting '<' to '<'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Input Validation Approaches and Filtering CASENET Practice Questions (Page 9)

Questions 41–45

A .NET web application uses ASP.NET MVC with data annotations for model validation. The team wants to ensure that validation is enforced on the server. What is the best way to do this?

A .NET application allows users to upload files to a specific directory. The filename is taken from the user and used to construct the full path. The team wants to prevent path traversal while allowing legitimate filenames like 'report_v1.txt'. Which approach is most secure?

An ASP.NET Core Razor Pages application displays user-generated comments on a community forum. The development team wants to prevent stored XSS attacks while still allowing users to include basic formatting like bold text. What should they do?

Which of the following is a limitation of blacklist validation?

Which filtering technique replaces dangerous characters with a safe representation, such as converting '<' to '&lt;'?

Keep studying — Secure Coding: Input Validation

Which filtering technique replaces dangerous characters with a safe representation, such as converting '<' to '<'?