Input Validation for MVC CASENET Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   An MVC application is experiencing a high volume of failed validation attempts on a login form. The security team suspects automated attacks. The developer needs to log validation failures with enough detail to identify attack patterns while avoiding logging sensitive data. Which logging approach is most appropriate?

   • ALog only a generic message like 'Validation failed' without any additional details.
   • BLog the exception details and stack trace for every validation failure.
   • CLog the ModelState errors, the timestamp, the IP address, and the username attempted, but mask or exclude the password.
   • DLog the full ModelState dictionary including all submitted form values, including the password.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   An MVC application uses [Remote] validation to check if an email address is already registered. The remote validation action is implemented as a public controller action that returns JsonResult. A security review flags that the action is vulnerable to enumeration attacks because it reveals whether an email is registered. Which mitigation is most appropriate?

   • AAdd rate limiting to the remote validation action to limit the number of requests per IP address.
   • BReturn a generic 'invalid' response for all email addresses to prevent enumeration.
   • CAdd [Authorize] to the remote validation action so only authenticated users can check email availability.
   • DRemove the [Remote] attribute and perform the uniqueness check only on form submission.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Why is it important to log validation failures in an MVC application?

   • ATo support security monitoring and detect potential attack patterns
   • BTo encrypt the user's data
   • CTo automatically fix the invalid input
   • DTo improve the performance of the application
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An e-commerce application has a checkout form where users enter a start date and an end date for a rental period. The business rule requires that the end date must be after the start date. The team wants to enforce this rule as part of the model validation so that the controller action can check ModelState.IsValid and return a validation error if the rule is violated. Which approach should be used?

   • AImplement IValidatableObject on the model class and add a validation error in the Validate method if EndDate <= StartDate.
   • BAdd a [Range] attribute to the EndDate property with the minimum value set to the StartDate property value.
   • CApply a [Compare] attribute to the EndDate property with the StartDate property as the comparison target.
   • DPerform the date comparison in the controller action and add a ModelState error manually if the dates are invalid.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A financial application has a login form. The security team wants to log all validation failures, such as when a user enters an invalid username or password, to support security monitoring and auditing. The development team needs to implement logging for validation failures in the controller action. Which approach should be used?

   • ACheck ModelState.IsValid in the controller action and log the validation errors using a logging framework if it is false.
   • BAdd a custom validation attribute that logs validation failures when the IsValid method is called.
   • CRely on the browser's console to log validation errors.
   • DUse a [Remote] validation attribute to log validation failures automatically.
   Reveal Solution Discussion Select an answer first