Authentication and Authorization Defensive Techniques CASENET Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which session management practice is specifically designed to prevent session fixation attacks?

   • ASetting a short session timeout
   • BUsing the Secure cookie attribute
   • CRegenerating the session ID after login
   • DEncrypting the session data
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A .NET application's login endpoint is vulnerable to distributed brute-force attacks where attackers rotate IP addresses. The current account lockout policy locks an account after 5 failed attempts. Attackers are still able to try many passwords by using different IPs. Which additional control should be implemented?

   • AImplement rate limiting per user account, not just per IP.
   • BDisable account lockout and rely on CAPTCHA.
   • CIncrease the lockout threshold to 10 failed attempts.
   • DUse a longer lockout duration, such as 24 hours.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An ASP.NET Core application uses cookie authentication. After a user logs in, the application issues a cookie that contains the user's role as a claim. A penetration test reveals that an attacker can modify the role claim in the cookie and gain admin access. What is the most effective way to prevent this?

   • AEncrypt the cookie using the Data Protection API.
   • BUse a server-side session store and keep only a random session ID in the cookie.
   • CSet the cookie's HttpOnly attribute to true.
   • DSign the cookie with a machine key.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A .NET application stores passwords using PBKDF2 with a per-user salt. The security team wants to increase the cost of brute-force attacks without causing excessive CPU load on the server. Which parameter should be adjusted?

   • AUse a faster hashing algorithm like MD5.
   • BStore the salt in a separate database.
   • CIncrease the iteration count of PBKDF2.
   • DIncrease the salt length.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A .NET application uses token-based authentication (JWT) for its API. The tokens are issued with a 24-hour expiration. The security team is concerned that if a token is stolen, it can be used for a long time. They want to reduce the risk without forcing users to log in frequently. Which approach is best?

   • AKeep the 24-hour expiration but add a token revocation list.
   • BEncrypt the JWT to prevent tampering.
   • CShorten the token expiration to 15 minutes and use refresh tokens.
   • DUse a longer expiration but require re-authentication for sensitive operations.
   Reveal Solution Discussion Select an answer first