LARAVEL Risk Assessment & Management 2 — Questions and Answers
Question 1: Which Laravel feature helps mitigate SQL injection risks when performing raw database queries?
- Using DB::statement() without bindings
- Using PDO parameter bindings via DB::select() with placeholders (Correct answer)
- Escaping values with htmlspecialchars()
- Disabling query logging
Correct answer: Using PDO parameter bindings via DB::select() with placeholders
Laravel's DB::select() and similar methods accept PDO-style parameter bindings that automatically escape values, preventing SQL injection.
Question 2: What risk does Laravel's `storage:link` command introduce if misconfigured?
- It disables the cache layer
- It exposes private uploaded files via a public symlink (Correct answer)
- It deletes temporary session files
- It resets the application key
Correct answer: It exposes private uploaded files via a public symlink
If the storage link points to a directory containing sensitive files, those files become publicly accessible through the web server.
Question 3: Which middleware should be applied to routes that mutate state in order to reduce CSRF risk?
- throttle
- auth
- VerifyCsrfToken (Correct answer)
- signed
Correct answer: VerifyCsrfToken
The VerifyCsrfToken middleware checks that POST/PUT/PATCH/DELETE requests carry a valid CSRF token, preventing cross-site request forgery.
Question 4: A Laravel app stores API credentials directly in controller code. What is the primary risk management remedy?
- Move credentials to .env and access them via config() or env() (Correct answer)
- Encode credentials with base64 before embedding them
- Store credentials in the database users table
- Add the controller file to .gitignore
Correct answer: Move credentials to .env and access them via config() or env()
Credentials belong in .env (excluded from VCS) and should be read through Laravel's config layer, keeping secrets out of source code.
Question 5: How does Laravel's signed URL feature reduce risk for sensitive one-time actions like email verification?
- It encrypts the entire URL with AES-256
- It appends an HMAC signature that expires, preventing URL tampering or reuse (Correct answer)
- It forces the user to log in before accessing the URL
- It stores the URL hash in the session for later comparison
Correct answer: It appends an HMAC signature that expires, preventing URL tampering or reuse
Signed URLs include a cryptographic signature and optional expiry, so they cannot be forged or reused after expiration.
Question 6: What is the risk of setting APP_DEBUG=true in a Laravel production environment?
- It doubles memory usage
- It disables Artisan commands
- It exposes stack traces, environment variables, and internal paths to end users (Correct answer)
- It forces synchronous queue processing
Correct answer: It exposes stack traces, environment variables, and internal paths to end users
Debug mode renders detailed error pages with sensitive application internals, giving attackers a roadmap to vulnerabilities.
Question 7: Which Laravel console command helps identify potentially vulnerable or outdated package dependencies from a risk perspective?
- php artisan package:discover
- composer audit (Correct answer)
- php artisan vendor:publish
- composer dump-autoload
Correct answer: composer audit
composer audit checks installed packages against the PHP Security Advisories Database and reports known vulnerabilities.
LARAVEL Risk Assessment & Management 2
Which Laravel feature helps mitigate SQL injection risks when performing raw database queries?