Authentication and Authorization Defensive Techniques CASENET Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which defensive technique is used to prevent cross-site scripting (XSS) attacks by ensuring that user-supplied data is treated as data, not executable code, when rendered in a web page?

   • AInput validation
   • BSession timeout
   • COutput encoding
   • DSecure error handling
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An ASP.NET Core application has a complex authorization requirement: users can edit a document only if they are the owner OR if they are in the 'Editor' role AND the document is not locked. The application currently uses role-based authorization only. What is the best way to implement this?

   • AUse a custom authorization policy with a requirement and handler that checks ownership, role, and lock status.
   • BUse role-based authorization with the [Authorize(Roles = "Editor")] attribute.
   • CCheck the conditions in the controller action and return 403 if not met.
   • DUse claims-based authorization with a claim for 'DocumentOwner'.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In ASP.NET Core, which authorization approach allows you to define access rules based on the presence of specific claims (e.g., 'Department' claim with value 'IT') rather than just the user's role?

   • AClaims-based authorization
   • BPolicy-based authorization
   • CRole-based authorization
   • DResource-based authorization
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which cookie attribute should be set to 'true' to prevent client-side JavaScript from accessing the authentication cookie, thereby mitigating cross-site scripting (XSS) attacks?

   • ASameSite
   • BExpires
   • CHttpOnly
   • DSecure
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A .NET application's login endpoint is being attacked with a credential stuffing attack, where attackers use lists of usernames and passwords from other breaches. The current lockout policy locks an account after 5 failed attempts, but attackers are using many different usernames to avoid lockouts. Which control should be added to mitigate this?

   • AImplement rate limiting on the login endpoint based on IP address.
   • BDisable account lockout and rely on CAPTCHA.
   • CIncrease the lockout threshold to 10 failed attempts.
   • DImplement a password breach check that rejects passwords found in known breach lists.
   Reveal Solution Discussion Select an answer first