Input Validation for MVC CASENET Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When handling an AJAX request that fails validation, what is the recommended way to return validation errors to the client?

   • AReturn an HTTP 500 status code with no body
   • BReturn a JSON object containing the validation errors
   • CReturn a plain text error message
   • DRedirect the user to an error page
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which method must you override when creating a custom validation attribute?

   • AOnActionExecuting
   • BOnResultExecuted
   • CValidate
   • DIsValid
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An MVC application has a controller action that handles both form posts and AJAX requests. The form includes an anti-forgery token. The developer notices that AJAX requests are failing because the anti-forgery token is not being submitted. The application uses jQuery to make AJAX requests. Which change is most appropriate to fix the issue while maintaining CSRF protection?

   • AAdd the anti-forgery token to the AJAX request headers by reading it from a meta tag in the layout and including it in the request.
   • BDisable the anti-forgery token for the form and rely on AJAX-specific CSRF protection.
   • CRemove the [ValidateAntiForgeryToken] attribute from the controller action for AJAX requests.
   • DUse a GET request instead of POST for the AJAX call to avoid the anti-forgery token requirement.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An MVC application has a controller action that processes a complex form. The action currently logs validation failures using a generic logging framework. A security audit requires that validation failures be logged with enough detail to support forensic analysis, but the application must comply with data protection regulations that prohibit logging personal data. Which logging strategy satisfies both requirements?

   • ALog the validation error messages, the property names that failed, a correlation ID, and the timestamp, but exclude the actual submitted values.
   • BLog only the timestamp and a generic 'validation failed' message.
   • CLog the username and password submitted in the form for authentication-related validation failures.
   • DLog the full submitted form data including all field values for complete forensic analysis.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of output encoding in MVC views?

   • ATo compress the HTML output to reduce bandwidth
   • BTo encrypt data before sending it to the browser
   • CTo validate that user input is in the correct format
   • DTo prevent cross-site scripting (XSS) attacks by rendering user input as harmless text
   Reveal Solution Discussion Select an answer first