Input Related Flaws and Input Validation GWEB Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A web application accepts a 'quantity' parameter that should be an integer between 1 and 100. The application currently checks only that the value is numeric. A tester submits '1e3' and the application accepts it as 1000. Which validation technique would best prevent this?

   • AUse a regular expression that allows digits and a decimal point.
   • BConvert the input to a float and then check if it is less than 100.
   • CCheck that the input length is less than 3 characters.
   • DUse a strict integer type check and a range check (1–100) on the server.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A web application has a centralized validation module that logs every validation failure with the full input value and a detailed reason. A security review finds that the logs are accessible to all developers. Which change best balances security and debuggability?

   • ALog validation failures only for authenticated users, not for anonymous requests.
   • BLog a generic error code and a sanitized version of the input, and restrict log access to a small group of security and operations staff.
   • CContinue logging full input values but encrypt the logs at rest.
   • DRemove logging of validation failures entirely to protect sensitive data.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A large organization has many web applications developed by different teams. A recent penetration test found that some applications validate input on the client side only, while others use inconsistent server-side rules. The CISO wants a standardized approach that is enforceable across all applications. Which solution best meets this goal?

   • ACreate a security checklist and require teams to self-attest compliance.
   • BMandate that all applications use client-side validation frameworks.
   • CImplement a centralized validation service or shared library that all applications must integrate.
   • DRequire all applications to use a web application firewall (WAF) with a common rule set.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A web application uses a parameter 'id' that is validated as an integer. The application also supports a legacy parameter 'id2' that is not validated. An attacker submits both 'id=1' and 'id2=1 OR 1=1' and the application uses the last value in a SQL query. What is the most effective countermeasure?

   • AApply the same integer validation to all parameters, including 'id2', and reject requests with duplicate parameters.
   • BUse a WAF to block requests with multiple parameters of the same name.
   • CReject any request that contains both 'id' and 'id2' parameters.
   • DDocument that 'id2' is deprecated and should not be used.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is a key benefit of using a centralized validation mechanism in a web application?

   • AIt automatically fixes any invalid input without user notification
   • BIt makes the application faster by reducing the number of validation checks
   • CIt eliminates the need for output encoding
   • DIt ensures consistent validation rules are applied across all input points, reducing the risk of missing a check
   Reveal Solution Discussion Select an answer first