Application Security (Security+): Input Validation & Sandboxing Quiz

1. What is parameterized query (prepared statement) primarily used to prevent?

Slow database performance

SQL injection attacks

Network latency

User authentication failures

2. True or False: Input validation should occur only on the client-side for security purposes.

True

False

3. What is the main security benefit of using a containerized sandbox environment?

Improved application performance

Isolation of processes to prevent lateral movement

Automatic backup of application data

Reduced software licensing costs

4. Which vulnerability occurs when an application executes operating system commands based on unsanitized user input?

Command injection

Path traversal

Directory listing

Privilege escalation

5. True or False: Code review is an effective control for identifying input validation vulnerabilities.

True

False

6. What is canonicalization in input validation?

Converting input to a standard format before validation

Encrypting input data with canonical ciphers

Logging all user input

Removing all special characters from input

7. Which of the following best describes the purpose of a Web Application Firewall (WAF)?

To block all internet traffic

To monitor and filter HTTP requests for malicious patterns

To encrypt all network packets

To prevent users from accessing external websites

8. True or False: Output encoding prevents stored XSS attacks.

True

False

9. What does the principle of least privilege mean in application security?

Users should have only the minimum permissions needed

Administrators should have all permissions

Encryption should use the smallest key size

Applications should run with maximum privileges

10. Which encoding method is used to safely represent data in URLs?

Base64 encoding

URL encoding (percent encoding)

MD5 hashing

RSA encryption

11. What is the primary goal of input validation in application security?

To encrypt all user-supplied data

To ensure data conforms to expected format, type, and range

To log every keystroke a user enters

To prevent users from accessing the database

12. True or False: Sandboxing can completely eliminate all security risks in an application.

True

False

13. Which secure coding practice prevents buffer overflow attacks?

Using unbounded string functions like strcpy()

Implementing bounds checking on array access

Disabling all security warnings during compilation

Using global variables for memory management

14. What type of attack occurs when an attacker injects JavaScript code into a web application that executes in a victim's browser?

Cross-site scripting (XSS)

Cross-site request forgery (CSRF)

Command injection

LDAP injection

15. Which of the following is NOT a common input validation control?

Format validation

Presence validation

Biometric validation

Range validation

16. True or False: Blacklist validation is generally more secure than whitelist validation.

True

False

17. What is a whitelist in the context of input validation?

A list of users allowed to access the application

A predefined set of acceptable input values or characters

A log of all rejected user inputs

A database of known malicious IP addresses

18. Which input validation technique checks if a string length does not exceed a maximum value?

Type checking

Range validation

Length validation

Whitelist comparison

19. What does a sandbox environment do in application security?

Isolates untrusted code to limit damage if exploited

Encrypts all network traffic

Removes all user permissions

Prevents compilation of source code

20. Which attack exploits insufficient input validation by inserting malicious code into a database query?

Cross-site scripting (XSS)

SQL injection

Buffer overflow

Man-in-the-middle attack

App Security Quiz: Can You Master Input Validation & Sandboxing?

1. What is parameterized query (prepared statement) primarily used to prevent?

2.

What first name or nickname would you like us to use?

2. True or False: Input validation should occur only on the client-side for security purposes.

3. What is the main security benefit of using a containerized sandbox environment?

4. Which vulnerability occurs when an application executes operating system commands based on unsanitized user input?

5. True or False: Code review is an effective control for identifying input validation vulnerabilities.

6. What is canonicalization in input validation?

7. Which of the following best describes the purpose of a Web Application Firewall (WAF)?

8. True or False: Output encoding prevents stored XSS attacks.

9. What does the principle of least privilege mean in application security?

10. Which encoding method is used to safely represent data in URLs?

11. What is the primary goal of input validation in application security?

12. True or False: Sandboxing can completely eliminate all security risks in an application.

13. Which secure coding practice prevents buffer overflow attacks?

14. What type of attack occurs when an attacker injects JavaScript code into a web application that executes in a victim's browser?

15. Which of the following is NOT a common input validation control?

16. True or False: Blacklist validation is generally more secure than whitelist validation.

17. What is a whitelist in the context of input validation?

18. Which input validation technique checks if a string length does not exceed a maximum value?

19. What does a sandbox environment do in application security?

20. Which attack exploits insufficient input validation by inserting malicious code into a database query?