LARAVEL Risk Assessment & Management 2

Question 1

Which Laravel feature helps mitigate SQL injection risks when performing raw database queries?

Accepted Answer

Using PDO parameter bindings via DB::select() with placeholders

Answer

Laravel's DB::select() and similar methods accept PDO-style parameter bindings that automatically escape values, preventing SQL injection.

Question 2

What risk does Laravel's `storage:link` command introduce if misconfigured?

Accepted Answer

It exposes private uploaded files via a public symlink

Answer

If the storage link points to a directory containing sensitive files, those files become publicly accessible through the web server.

Question 3

Which middleware should be applied to routes that mutate state in order to reduce CSRF risk?

Accepted Answer

VerifyCsrfToken

Answer

The VerifyCsrfToken middleware checks that POST/PUT/PATCH/DELETE requests carry a valid CSRF token, preventing cross-site request forgery.

Question 4

A Laravel app stores API credentials directly in controller code. What is the primary risk management remedy?

Accepted Answer

Move credentials to .env and access them via config() or env()

Answer

Credentials belong in .env (excluded from VCS) and should be read through Laravel's config layer, keeping secrets out of source code.

Question 5

How does Laravel's signed URL feature reduce risk for sensitive one-time actions like email verification?

Accepted Answer

It appends an HMAC signature that expires, preventing URL tampering or reuse

Answer

Signed URLs include a cryptographic signature and optional expiry, so they cannot be forged or reused after expiration.

LARAVEL - Laravel PHP Framework Practice Test