Input Validation for MVC CASENET Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A developer is building an ASP.NET MVC registration form for a financial services application. The form collects a username, email address, and account balance. The username must be 6–20 characters and contain only letters and digits. The email must be a valid format. The account balance must be between 0 and 1,000,000. The developer wants to enforce these rules declaratively on the model so that validation is automatically applied both when the form is posted and when the model is bound from an API request. Which approach satisfies the requirement with the least custom code?

   • AAdd [Required] to all properties and perform manual validation checks inside the controller action using if statements.
   • BAdd [Required], [StringLength(20, MinimumLength = 6)], [RegularExpression(@"^[a-zA-Z0-9]+$")] to Username, [EmailAddress] to Email, and [Range(0, 1000000)] to AccountBalance.
   • CAdd [Required] to all three properties and write a custom ValidationAttribute for each property to enforce the specific rules.
   • DAdd [Required] and [StringLength(20)] to Username, [EmailAddress] to Email, and [Range(0, 1000000)] to AccountBalance, then rely on client-side validation only.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An MVC application has a form that allows users to change their email address. The form is protected with an anti-forgery token. A security review notes that the controller action that processes the form does not validate the anti-forgery token. Which change is required to enforce CSRF protection?

   • AAdd [Authorize] attribute to the controller action that processes the form.
   • BAdd [ValidateAntiForgeryToken] attribute to the controller action that processes the form.
   • CAdd [HttpPost] attribute to the controller action that processes the form.
   • DAdd [ValidateInput(false)] attribute to the controller action that processes the form.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In Razor views, how does the @ symbol affect output encoding by default?

   • AIt disables encoding to allow raw HTML
   • BIt HTML-encodes the output by default
   • CIt does not encode; encoding must be done manually
   • DIt only encodes if the value is a string
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How can you display validation error messages to the user in an MVC view?

   • AUsing Html.BeginForm
   • BUsing Html.ValidationMessageFor or Html.ValidationSummary
   • CUsing Html.TextBoxFor
   • DUsing Html.ActionLink
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of the anti-forgery token in ASP.NET MVC forms?

   • ATo prevent cross-site request forgery (CSRF) attacks by ensuring the request originated from the application's own form
   • BTo prevent SQL injection attacks
   • CTo validate that the user input is in the correct format
   • DTo encrypt the form data before submission
   Reveal Solution Discussion Select an answer first