Input Related Flaws and Input Validation GWEB Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   When a user submits invalid input, what is the recommended way to handle the error message?

   • AReturn the original input in the error message so the user can see what they typed
   • BReturn a generic error message that does not reveal specific validation rules or system details
   • CReturn a detailed error message that lists all the validation rules that were violated
   • DLog the error but do not show any message to the user
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A web application has a search feature that reflects user input in the HTML response. The application uses a WAF that blocks requests containing '<script>'. A security engineer discovers that the WAF can be bypassed using a double-encoded payload, and the application then reflects the decoded payload without encoding. The team must decide between two fixes: (1) configure the WAF to decode twice, or (2) add output encoding in the application. Which approach is the most robust long-term solution?

   • AAdd output encoding in the application so that reflected input is rendered as text.
   • BConfigure the WAF to decode input twice before applying rules.
   • CReject any request that contains a percent sign.
   • DUse a denylist that includes both single- and double-encoded versions of '<script>'.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A web application has a search feature that takes a 'q' parameter and uses it in three different contexts: an SQL query, an HTML response, and a JavaScript variable. The development team is designing validation for this parameter. What is the most important consideration?

   • AA single allowlist of alphanumeric characters is sufficient for all three contexts.
   • BClient-side validation is sufficient because the input is used in the browser.
   • CValidation must be context-specific because the same input may need different rules for SQL, HTML, and JavaScript.
   • DValidation should be performed only on the SQL context because it is the most dangerous.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Why is context-specific validation necessary for input that will be used in different parts of an application?

   • ABecause the same input may be safe in one context (e.g., HTML) but dangerous in another (e.g., SQL), so validation must match the intended use
   • BBecause validation is only required for SQL queries, not for HTML output
   • CBecause each programming language requires a different validation syntax
   • DBecause the same validation rules can be applied to all contexts if they are strict enough
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which validation technique would best ensure that a username contains only letters, numbers, and underscores?

   • AFormat check using a regular expression like ^[a-zA-Z0-9_]+$
   • BRange check to ensure the username is between 0 and 100
   • CLength check to ensure the username is between 3 and 20 characters
   • DType check to confirm the input is a string
   Reveal Solution Discussion Select an answer first