Security and Programmatic Access PLATFORM-DEVELOPER-I Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A Visualforce page displays a user's first name and last name in a greeting. The developer wants to prevent XSS but also needs to allow some HTML formatting in the last name (e.g., bold). Which approach is the most secure?

   • AEscape the first name and use a whitelist of allowed HTML tags for the last name before displaying it with <apex:outputText escape="false">.
   • BUse <apex:outputField> for both fields.
   • CUse <apex:outputText escape="false"> for both fields.
   • DEscape both the first name and last name using <apex:outputText> with default escaping.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When building a dynamic SOQL query, which of the following is the recommended way to incorporate a field name that is determined at runtime?

   • AConcatenate the field name directly into the query string
   • BUse escapeSingleQuotes on the field name
   • CUse Database.queryWithBinds with a field name bind
   • DUse a bind variable for the field name
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which attribute on <apex:outputText> can be used to disable HTML escaping?

   • AhtmlEscape
   • Bencode
   • Cescape
   • Dsanitize
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which technique is the most effective way to prevent SOQL injection in Apex?

   • AUsing bind variables in SOQL queries
   • BUsing Database.query with concatenation
   • CUsing String.isBlank() to validate input
   • DUsing escapeSingleQuotes on all input
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which HTTP method is generally recommended for state-changing operations in Visualforce to help prevent CSRF attacks?

   • APUT
   • BGET
   • CPOST
   • DDELETE
   Reveal Solution Discussion Select an answer first