Input Validation for MVC CASENET Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which method must be implemented when a class implements IValidatableObject?

   • AValidateModel()
   • BValidate(ValidationContext validationContext)
   • COnValidating()
   • DIsValid(object value)
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An MVC application has a model with a [Required] attribute on the Title property. When a user submits the form without a title, the controller action checks ModelState.IsValid and returns the view with the model. The view uses asp-validation-for to display errors. However, the error message is not displayed. What is the most likely cause?

   • AThe model property is named 'title' (lowercase) instead of 'Title'.
   • BThe [Required] attribute is not being enforced because client-side validation is disabled.
   • CThe controller action is not checking ModelState.IsValid before returning the view.
   • DThe view does not include a <span asp-validation-for="Title"></span> element.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A developer is implementing input validation for a 'Country' field in an MVC registration form. The application must accept any valid country name. The developer is considering whether to use a whitelist or a blacklist approach. The security team has mandated whitelist validation. Which implementation best satisfies the mandate while maintaining usability?

   • AUse a dropdown list populated from a server-side whitelist of valid country names, and validate the submitted value against that same whitelist on the server.
   • BUse a free-text input field and validate it against a blacklist of dangerous characters like '<', '>', and 'script'.
   • CUse a free-text input field and rely on client-side validation to restrict input to known country names.
   • DUse a free-text input field and validate it with a regular expression that allows letters, spaces, and hyphens.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A web application has a form where users enter a phone number. The business requirement is that the phone number must be in the format XXX-XXX-XXXX, where X is a digit. The development team wants to enforce this rule using declarative validation on the model. Which regular expression should be used in the [RegularExpression] attribute?

   • A^\d{3}-\d{3}-\d{4}$
   • B^\d{10}$
   • C^\d{3}-\d{4}-\d{3}$
   • D^\d+$
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Why is whitelist validation generally preferred over blacklist validation for security?

   • AWhitelist validation is easier to implement than blacklist
   • BWhitelist validation does not require regular expressions
   • CWhitelist validation is faster than blacklist
   • DWhitelist validation only allows known-good input, reducing the risk of bypasses
   Reveal Solution Discussion Select an answer first