Input Related Flaws and Input Validation GWEB Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A web application has a multi-step form where the first step validates the email address format on the client side, and the second step submits the data to the server. The server does not re-validate the email address. A tester bypasses the client-side validation and submits an invalid email address, which causes a server error that reveals a stack trace. Which combination of fixes best addresses the security issues?

   • AUse a WAF to block requests with invalid email addresses.
   • BStrengthen the client-side validation to use a more comprehensive email regex.
   • CAdd a hidden field that indicates the client-side validation passed and check it on the server.
   • DAdd server-side validation for the email address and configure the application to return a generic error page for unhandled exceptions.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When is an allowlist (whitelist) validation approach most appropriate?

   • AWhen the set of acceptable input values is well-defined and finite, such as a list of country codes
   • BWhen the application must accept any input that does not contain known attack patterns
   • CWhen the input is a numeric value that can be any integer
   • DWhen the input can be any free-form text, such as a comment field
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A large web application has multiple development teams that each build microservices. Each service has its own input validation logic, leading to inconsistent security controls. A security architect proposes a centralized validation service. Which consideration is most important when implementing this?

   • AThe centralized service should only validate input for new services, not existing ones.
   • BThe centralized service should be implemented as a client-side JavaScript library.
   • CThe centralized service should log all validation failures with detailed error messages to help developers debug.
   • DThe centralized service must be highly available and low-latency because every request depends on it.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A web form asks for a user's age. Which validation technique is most appropriate to ensure the age is a reasonable number?

   • AFormat check to match a regular expression for digits only
   • BRange check to verify the value is between 18 and 120
   • CType check to confirm the input is a string
   • DLength check to ensure the input is exactly two characters
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is it important to decode (or canonicalize) input before performing validation?

   • ATo ensure that encoded payloads, such as %27 for a single quote, are checked in their decoded form so they cannot bypass validation
   • BTo make the input smaller and easier to process
   • CTo convert all characters to uppercase for case-insensitive comparison
   • DTo ensure that the input is encrypted before it is stored
   Reveal Solution Discussion Select an answer first