Input Validation for Web Forms CASENET Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A web application has a form with a field for a coupon code. The coupon code must be validated against a database to ensure it is active and not expired. The team is using a CustomValidator. Which approach should be used to implement this validation?

   • AIn the server-side validation function, query the database to check if the coupon code exists, is active, and has not expired, then set args.IsValid accordingly.
   • BUse a RequiredFieldValidator to ensure the field is not empty and rely on the server to reject invalid codes after form submission.
   • CUse a CompareValidator to compare the coupon code with a hidden field containing the list of valid codes.
   • DUse a RegularExpressionValidator to check the format of the coupon code and assume it is valid.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial services company is deploying an ASP.NET web application for customer account registration. The development team has implemented client-side validation using JavaScript to enforce required fields and email format. The security team has mandated that the application must not rely solely on client-side validation. Which additional measure should the team implement to meet this requirement?

   • AIncrease the complexity of the JavaScript validation to include more patterns and edge cases.
   • BAdd server-side validation using ASP.NET validation controls and model validation attributes.
   • CUse HTTPS to encrypt the data between the client and server, ensuring validation cannot be tampered with.
   • DRely on the database constraints to reject invalid data, since they are enforced at the data layer.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A developer needs to validate that a username is not already taken in the database. Which approach is most appropriate?

   • AUse a RegularExpressionValidator to check the username format.
   • BUse a RangeValidator to ensure the username is within a certain length.
   • CImplement custom validation logic in code-behind that queries the database.
   • DUse a RequiredFieldValidator to ensure the field is not empty.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An application has a form that accepts a user's email address. When the email is invalid, the application throws an exception that is displayed to the user, including the stack trace. The security team has requested that this be fixed. Which approach should be taken?

   • AUse a RegularExpressionValidator to prevent invalid emails from being submitted.
   • BRedirect the user to a generic error page without logging the exception.
   • CDisplay the exception details only to users with a specific role.
   • DCatch the exception, log the details server-side, and display a generic error message to the user.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An ASP.NET web forms application has a registration form with fields for Username, Email, Password, and Confirm Password. The team wants to enforce that the Username contains only alphanumeric characters and is between 6 and 20 characters. Which combination of ASP.NET validation controls should be used?

   • ACompareValidator and RangeValidator
   • BCustomValidator and RequiredFieldValidator
   • CRequiredFieldValidator and RegularExpressionValidator
   • DRegularExpressionValidator and CompareValidator
   Reveal Solution Discussion Select an answer first