Input Validation for ASP.NET Core CASENET Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which class provides static methods to validate an object outside of the model-binding pipeline?

   • AValidationContext
   • BDataAnnotationsValidator
   • CModelState
   • DValidator
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An ASP.NET Core Web API controller is decorated with [ApiController]. When a POST request contains invalid model data, the API automatically returns a 400 response. The team wants to ensure the response body follows the ProblemDetails format and includes validation errors. What should they do?

   • AConfigure the [Remote] attribute on each property to return ProblemDetails.
   • BDo nothing; [ApiController] automatically returns a ProblemDetails response with validation errors when ModelState is invalid.
   • CAdd a custom exception filter to convert all exceptions to ProblemDetails.
   • DManually check ModelState.IsValid and return BadRequest(ModelState) in every action.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   An ASP.NET Core MVC application has a form that accepts a `Url` property. The team wants to prevent stored XSS by validating that the URL is well-formed and only allows HTTP/HTTPS schemes. They also want to ensure that the URL is not used in an unsafe way in views. Which combination of measures is most appropriate?

   • AUse a custom validation attribute that checks the scheme and rely on Razor's default encoding.
   • BUse a [Url] attribute for format validation and always HTML-encode the URL when rendering it in views.
   • CUse the [Remote] attribute to validate the URL on the server and return a JSON result.
   • DSanitize the URL by removing all non-alphanumeric characters.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A team is building a batch import feature in an ASP.NET Core application. The import file contains rows that are mapped to objects with data annotations. The team wants to validate each object and collect all validation errors for reporting, but they do not want to stop at the first error. They also need to ensure that the validation does not rely on the HTTP pipeline. Which approach should they use?

   • AUse ModelState.IsValid for each object.
   • BUse Validator.TryValidateObject with validateAllProperties set to true for each object and collect the results.
   • CManually check each property and add errors to a list.
   • DUse Validator.ValidateObject with validateAllProperties set to true for each object.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A developer is creating a custom validation attribute that needs to access the value of another property on the same model. The attribute is applied to the Email property and must check that the Email does not match the UserName property. The developer has overridden IsValid(ValidationContext context). What should the developer do to access the UserName property?

   • AUse context.Items to store the UserName value.
   • BUse context.MemberName to get the UserName property.
   • CUse context.ObjectType to get the UserName property.
   • DUse context.ObjectInstance to get the model instance and then read the UserName property via reflection.
   Reveal Solution Discussion Select an answer first