A .NET application uses a SQL query built by concatenating a user-supplied `categoryId` string directly into a `SELECT` statement. An attacker submits `1 OR 1=1` and retrieves all records. The team decides to fix the issue. Which change is the most appropriate?

Validate that `categoryId` contains only digits using a regular expression.

Use a stored procedure that concatenates the input inside the procedure.

Escape single quotes in the input before concatenation.

Replace the concatenated query with a parameterized query using `SqlParameter`.

A .NET application has a file upload feature that accepts PDF files. The application checks the file extension and content type header, but a tester successfully uploads a file with a .pdf extension that contains an ASPX script. The file is stored in a directory that is served by IIS. Which additional control is most effective in preventing this attack?

Rename the file to a random name with a .pdf extension

Store uploaded files outside the web root and serve them via a handler that sets the Content-Type to application/pdf

Validate the file's magic bytes to ensure it is a real PDF

Add a deny rule in IIS for .pdf files

A .NET developer is writing a method that logs user actions. The method accepts a username and an action description. The log entries are stored in a text file and later displayed in an internal admin portal. Which implementation best follows secure coding practices?

Write the raw input to the log and restrict access to the file

Use a blacklist to filter out common malicious strings

Store the log in plain text and rely on the admin portal to sanitize output

Encode the username and action before writing to the log file

In application design, what is the purpose of implementing input validation on both the client side and the server side?

To ensure that all data is sanitized and safe to use, since client-side validation can be bypassed

To improve the user experience by providing immediate feedback on input errors

To reduce the amount of data transmitted over the network

To eliminate the need for output encoding

EC-CouncilCertified Application Security Engineer (.NET)

Domain 1Objective 1

Understanding Application Security, Threats, and Attacks CASENET Practice Questions (Page 2)

Part of the Application Security Foundations domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

4concepts

Questions 6–10

6application · medium
A .NET application uses a SQL query built by concatenating a user-supplied `categoryId` string directly into a `SELECT` statement. An attacker submits `1 OR 1=1` and retrieves all records. The team decides to fix the issue. Which change is the most appropriate?
Select an answer first
7expert · hard
A .NET application has a file upload feature that accepts PDF files. The application checks the file extension and content type header, but a tester successfully uploads a file with a .pdf extension that contains an ASPX script. The file is stored in a directory that is served by IIS. Which additional control is most effective in preventing this attack?
Select an answer first
8application · medium
A .NET developer is writing a method that logs user actions. The method accepts a username and an action description. The log entries are stored in a text file and later displayed in an internal admin portal. Which implementation best follows secure coding practices?
Select an answer first
9foundation · easy
In application design, what is the purpose of implementing input validation on both the client side and the server side?
Select an answer first
10foundation · easy
Which security principle ensures that a user or process is granted only the minimum privileges necessary to perform its required functions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Understanding Application Security, Threats, and Attacks CASENET Practice Questions (Page 2)

Questions 6–10

A .NET application uses a SQL query built by concatenating a user-supplied `categoryId` string directly into a `SELECT` statement. An attacker submits `1 OR 1=1` and retrieves all records. The team decides to fix the issue. Which change is the most appropriate?

A .NET developer is writing a method that logs user actions. The method accepts a username and an action description. The log entries are stored in a text file and later displayed in an internal admin portal. Which implementation best follows secure coding practices?

In application design, what is the purpose of implementing input validation on both the client side and the server side?

Which security principle ensures that a user or process is granted only the minimum privileges necessary to perform its required functions?

Keep studying — Application Security Foundations