CASE Secure Coding for Input Validation

Question 1

Which input validation approach is generally considered the most secure?

Accepted Answer

Whitelisting allowed characters, formats and ranges

Answer

Whitelist (allow-list) validation accepts only input that matches a known-good pattern. That makes it much harder to bypass than blacklists, which miss new or encoded attack strings. Client-side checks are easy to get around and must always be repeated on the server.

Question 2

What is the primary defense against SQL injection in Java or .NET applications?

Accepted Answer

Using parameterized queries (PreparedStatement / SqlParameter)

Answer

Parameterized queries keep the query structure separate from the data, so user input can never be read as SQL. A stored procedure that builds dynamic SQL by concatenating input is still vulnerable.

Question 3

Why should input be canonicalized before it is validated?

Accepted Answer

To reduce input to its simplest standard form so encoded attack strings can't slip past validation

Answer

Attackers use alternate encodings (URL encoding, double encoding, Unicode) to hide malicious payloads. Canonicalization decodes input to one standard form first, so validation checks the real value.

Question 4

Which control best prevents stored cross-site scripting (XSS)?

Accepted Answer

Context-aware output encoding when the data is rendered

Answer

Encoding output for its context (HTML body, attribute, JavaScript, URL) makes the browser treat user data as text rather than executable script. It works alongside input validation.

Question 5

An application builds a file path from a user-supplied filename. Which attack is most likely if the input is not validated?

Accepted Answer

Path (directory) traversal

Answer

Without validation, sequences like '../' let an attacker step out of the intended directory and read or write arbitrary files on the server.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Secure Coding for Input Validation