Input Related Flaws and Input Validation GWEB Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of why context-specific validation is needed?

   • AA semicolon is used as a statement separator in SQL and OS commands, but it is a normal character in HTML text
   • BA space is used to separate words in all contexts
   • CA letter 'a' is used in both SQL and HTML, so the same validation applies
   • DA comma is used as a decimal separator in some countries and as a list separator in others
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A developer is new to web security and asks why input validation is important. Which statement best explains the role of input validation in preventing injection attacks?

   • AInput validation is only needed for fields that are displayed to other users.
   • BInput validation ensures that data conforms to expected rules before it is processed, reducing the chance that malicious data reaches a vulnerable interpreter.
   • CInput validation encrypts all user input before it is stored in the database.
   • DInput validation replaces all special characters with safe alternatives.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A web application uses a WAF that blocks requests containing the string '<script>'. An attacker submits a request with the payload '%253Cscript%253E' (double URL-encoded) and the WAF does not block it, yet the application decodes it and executes the script. What is the most effective countermeasure?

   • AReject all requests that contain the '%' character.
   • BUse output encoding in the application so that any decoded input is rendered as data, not as executable script.
   • CConfigure the WAF to decode input multiple times before applying its rules.
   • DAdd '%253C' and '%253E' to the WAF's denylist.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following best distinguishes client-side validation from server-side validation?

   • AClient-side validation is faster and more secure than server-side validation
   • BClient-side validation is used for all input types, while server-side validation only works for text fields
   • CClient-side validation is required by law, while server-side validation is optional
   • DClient-side validation runs in the browser and is for user experience; server-side validation runs on the server and is for security
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A web application allows users to submit a 'country' field that is later used in a dropdown menu. The application currently uses a denylist to block a few known malicious strings. A security consultant recommends switching to an allowlist. Which scenario best justifies this recommendation?

   • AThe application needs to accept any future country that might be added.
   • BThe country field is only used in a dropdown, so validation is not necessary.
   • CThe set of valid countries is finite and well-defined, making an allowlist easy to implement and maintain.
   • DThe application uses a database that automatically sanitizes input.
   Reveal Solution Discussion Select an answer first