Input Validation for Web Forms CASENET Practice Questions (Page 7)

Questions 31–34

1. 31application · medium

   A social media application allows users to post comments that are displayed to other users. The development team is concerned about stored XSS attacks. They have implemented server-side validation that rejects any input containing `<script>` tags. Which additional control is necessary to prevent stored XSS?

   • AEncode all user-generated content when rendering it in the browser using the appropriate encoding context (HTML, attribute, JavaScript, etc.).
   • BStore all comments in a database field that is encrypted at rest.
   • CDisable JavaScript in the browser for all users of the application.
   • DUse a blacklist that blocks all HTML tags to prevent any markup from being rendered.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which practice is essential to prevent XSS when displaying user-generated content in an HTML page?

   • AHTML-encoding the output before rendering.
   • BUsing a blacklist to remove script tags from input.
   • CStoring the input in a database without any changes.
   • DDisabling JavaScript in the browser.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which ASP.NET validation control is used to ensure that a user has entered a value into a required field?

   • ARangeValidator
   • BCompareValidator
   • CRequiredFieldValidator
   • DRegularExpressionValidator
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   When a validation error occurs, what is the most secure way to provide feedback to the user?

   • ADisplay a generic error message that does not reveal internal details.
   • BLog the error in the browser console and show nothing to the user.
   • CDisplay the full exception details to help the user understand the problem.
   • DRedirect the user to a blank page.
   Reveal Solution Discussion Select an answer first