Input Related Flaws and Input Validation GWEB Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A junior developer asks why the team cannot rely solely on client-side validation for a web form. Which response best explains the security limitation?

   • AClient-side validation can be bypassed by sending crafted HTTP requests directly to the server.
   • BClient-side validation cannot handle complex validation rules.
   • CClient-side validation is slower than server-side validation.
   • DClient-side validation is only supported in modern browsers.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary countermeasure against double-encoding attacks that bypass input validation?

   • AUse a denylist of known attack strings to block any encoded input
   • BCanonicalize input by decoding it repeatedly until no further encoded characters remain before validation
   • CReject any input that contains a percent sign
   • DStore the input in a database without any processing
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company has multiple web applications that each implement their own input validation logic. A security audit finds inconsistent validation and several injection vulnerabilities. The company wants to standardize validation across all applications. Which approach is most effective?

   • ACreate a shared validation library that all applications must use for common input types.
   • BUse a web application firewall (WAF) to filter all incoming requests.
   • CAdd more client-side validation to each application.
   • DRequire each application to document its validation rules in a wiki.
   Reveal Solution Discussion Select an answer first
5. 14application · hard

   A web application performs input validation on a search parameter by checking for the substring 'OR 1=1'. An attacker submits '%4F%52%20%31%3D%31' and the query still returns all records. What is the most likely reason the validation was bypassed?

   • AThe application performed validation on the decoded value but the database stored the encoded value.
   • BThe application used allowlist validation that permitted URL-encoded characters.
   • CThe application used a denylist that did not include the '%' character.
   • DThe application decoded the input after validation, so the encoded payload was not seen by the validator.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How can a centralized validation mechanism be implemented in a web application?

   • ABy relying on the web server's configuration to validate all requests
   • BBy creating a reusable validation library or a common validation function that all input handlers call
   • CBy embedding validation code directly in every page's HTML
   • DBy using a database trigger to validate all data before it is inserted
   Reveal Solution Discussion Select an answer first