LARAVEL Risk Assessment & Management 3

Question 1

A Laravel application allows users to upload files. Which validation rule combination best mitigates malicious upload risks?

Accepted Answer

required|file|mimes:jpg,png,pdf|max:2048

Answer

Combining file, mimes (allowlist of extensions), and max (size cap) prevents executable uploads and oversized payloads.

Question 2

What risk does mass assignment pose in Laravel Eloquent, and what is the correct mitigation?

Accepted Answer

It allows attackers to set arbitrary model attributes; use $fillable or $guarded to restrict which fields can be set

Answer

Without $fillable or $guarded, a crafted POST request can set fields like is_admin, leading to privilege escalation.

Question 3

Which Laravel rate-limiting approach best reduces the risk of brute-force login attacks?

Accepted Answer

Applying the throttle:6,1 middleware to login routes

Answer

The throttle middleware limits requests per minute per IP, blocking repeated rapid attempts that characterize brute-force attacks.

Question 4

How should Laravel applications handle third-party JavaScript dependencies to reduce XSS supply-chain risk?

Accepted Answer

Use Subresource Integrity (SRI) hashes on CDN script tags

Answer

SRI hashes cause the browser to reject a script if its content has changed, protecting against CDN compromise.

Question 5

What is the security risk of using Laravel's `response()->download()` with user-supplied file paths without validation?

Accepted Answer

It can expose arbitrary server files via path traversal attacks

Answer

An attacker could supply paths like ../../etc/passwd to read files outside the intended directory.

LARAVEL - Laravel PHP Framework Practice Test