Which of the following is a critical validation check for file uploads to prevent malicious files?

Checking the file's last modified date

Checking the file's color depth

Checking the file extension against a whitelist of allowed types

A single-page application (SPA) uses AJAX to submit form data as JSON to an ASP.NET MVC controller action. The controller action needs to validate the incoming model and return validation errors in a format that the client-side JavaScript can easily process to display error messages next to the corresponding fields. Which approach should be used?

Return a 200 OK status code with the validation errors in the response body.

Redirect the user to a new view that displays the validation errors.

Throw an exception that is caught by the global error handler.

Return a 400 Bad Request status code with the ModelState errors serialized as JSON.

An MVC application allows users to upload profile pictures. The security team requires that only JPEG and PNG files under 2 MB are accepted. The developer needs to implement server-side validation to prevent malicious file uploads. Which validation approach is most secure?

Check the file extension against a whitelist of allowed extensions (.jpg, .jpeg, .png) and verify the file size is under 2 MB.

Check the file's MIME content type against a whitelist (image/jpeg, image/png) and verify the file size is under 2 MB.

Verify the file's magic bytes (signature) match JPEG or PNG, check the extension against a whitelist, and verify the file size is under 2 MB.

Check the file extension against a blacklist of dangerous extensions (.exe, .asp, .php) and verify the file size is under 2 MB.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 3Objective 4

Input Validation for MVC CASENET Practice Questions (Page 8)

Part of the Secure Coding: Input Validation domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 2–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

15concepts

15 Concepts in This Objective

MVC Input Validation Overview
Client-Side vs Server-Side Validation
Data Annotations for Validation
Custom Validation Attributes
IValidatableObject Interface
ModelState and Validation Errors
Validation in Controller Actions
Remote Validation
Anti-Forgery and Input Validation
Encoding and Output Validation
Validation for JSON and AJAX Requests
Securing File Uploads
Whitelist vs Blacklist Validation
Regular Expression Validation
Error Handling and Logging

Questions 36–40

36foundation · easy
Which of the following is a critical validation check for file uploads to prevent malicious files?
Select an answer first
37application · medium
A single-page application (SPA) uses AJAX to submit form data as JSON to an ASP.NET MVC controller action. The controller action needs to validate the incoming model and return validation errors in a format that the client-side JavaScript can easily process to display error messages next to the corresponding fields. Which approach should be used?
Select an answer first
38application · medium
An MVC application allows users to upload profile pictures. The security team requires that only JPEG and PNG files under 2 MB are accepted. The developer needs to implement server-side validation to prevent malicious file uploads. Which validation approach is most secure?
Select an answer first
39foundation · easy
What base class must a custom validation attribute inherit from in ASP.NET MVC?
Select an answer first
40foundation · easy
Which data annotation attribute would you use to enforce that a string property does not exceed 50 characters?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Input Validation for MVC CASENET Practice Questions (Page 8)

Questions 36–40

Which of the following is a critical validation check for file uploads to prevent malicious files?

An MVC application allows users to upload profile pictures. The security team requires that only JPEG and PNG files under 2 MB are accepted. The developer needs to implement server-side validation to prevent malicious file uploads. Which validation approach is most secure?

What base class must a custom validation attribute inherit from in ASP.NET MVC?

Which data annotation attribute would you use to enforce that a string property does not exceed 50 characters?

Keep studying — Secure Coding: Input Validation