Secure File Handling

Final Quiz

Connecting to LMS... Progress: in progress

Assessment

1. Why should applications treat uploaded filenames as untrusted? A. Filenames can be user-controlled and may contain misleading, unexpected, or unsafe values B. Filenames are always generated by the operating system C. Filenames automatically prove file content D. Filenames replace authorization checks

2. What is path traversal? A. Compressing a file before storage B. A risk where input influences file access outside an intended directory C. Encrypting a file path D. A normal upload status code

3. Why are extension checks insufficient by themselves? A. Extensions are always reliable B. Extensions prevent malicious content C. Extensions may be misleading or user-controlled and may not match actual content D. Extensions replace server-side validation

4. What is a safer storage-name pattern for uploaded files? A. Using the user-supplied filename directly as the storage path B. Storing every upload as index.html C. Trusting the browser to choose a safe name D. Generating a server-controlled storage name and keeping the original name only as metadata when needed

5. Why should upload size limits be enforced? A. To reduce resource exhaustion and oversized input risk B. To make every file public C. To replace access control D. To guarantee file content is safe

6. Why store sensitive uploads outside the web root where appropriate? A. It makes uploads impossible to delete B. It can reduce accidental direct web access to stored files C. It removes the need for authorization D. It automatically scans files

7. What should happen before a user downloads a protected file? A. The application should trust the filename B. The application should skip logging C. The application should verify authorization and ownership or sharing permissions D. The application should expose the storage path

8. What is a signed URL commonly used for? A. Replacing all authentication forever B. Encrypting every uploaded file automatically C. Validating file extensions D. Granting time-limited access to a specific resource under controlled conditions

9. Why should Content-Disposition be considered for downloads? A. It can influence whether content is displayed inline or treated as an attachment B. It hashes user passwords C. It rotates secrets D. It validates file size

10. Why can archive files be risky to process? A. They are always safe after upload B. They cannot contain nested files C. They may contain many files, large expanded content, unsafe paths, or unexpected structures D. They do not require validation

11. Why should temporary files be handled carefully? A. Temporary files are always encrypted B. Temporary files may expose sensitive data or remain after processing if cleanup fails C. Temporary files cannot affect security D. Temporary files replace access control

12. What should file-handling logs avoid? A. Timestamps B. Event types C. User identifiers D. Sensitive file contents or secrets

13. Why is least privilege important for file storage? A. It limits the damage from bugs, compromise, or unintended access B. It makes every file public C. It disables auditing D. It removes the need for validation

14. Why should exported files be reviewed for excessive data exposure? A. Exports are always safe B. Exports often aggregate data and may include fields the recipient should not receive C. Exports cannot contain sensitive data D. Exports replace authorization

15. Which statement best summarizes secure file handling? A. Trust every uploaded file after checking its extension B. Store uploads directly under public web paths by default C. Validate files, control names and paths, enforce authorization, process defensively, limit resources, log safely, and clean up properly D. Use client-side checks instead of server-side controls