A .NET application currently uses forms authentication with cookies. The security team wants to move to token-based authentication to support a mobile app. The application must also maintain session security. Which approach should be taken?

Use JWT tokens with a short expiry and refresh tokens stored in secure, HttpOnly cookies.

Use Windows authentication for both web and mobile clients.

Keep using forms authentication and add a separate API key for the mobile app.

Use JWT tokens stored in the browser's local storage and send them in the Authorization header.

A .NET application uses claims-based authorization. A user's claims are issued at login and stored in the authentication cookie. The business now requires that some permissions be revocable immediately when a user's employment status changes. Which approach should be used?

Keep the claims in the cookie but check the user's status in the database on each authorization request.

Use a short-lived cookie and re-issue claims on each request from the database.

Use a custom authorization filter that checks the user's status in the database only for sensitive actions.

Store the claims in a session variable and update it when employment status changes.

A .NET application has implemented TOTP-based MFA. Users are reporting that they are being locked out of their accounts because their authenticator app and the server are out of sync (time drift). The application uses a strict time window of 30 seconds. What is the best way to handle this without compromising security?

Require users to re-register their authenticator app.

Increase the time step to 5 minutes.

Disable MFA for users who experience time drift.

Allow a grace period of one time step before and after the current time.

Which authorization strategy in ASP.NET Core is most appropriate when you need to restrict access to an action method to users who belong to the 'Administrator' role?

Impersonation-based authorization

EC-CouncilCertified Application Security Engineer (.NET)

Domain 4Objective 3

Authentication and Authorization Defensive Techniques CASENET Practice Questions (Page 3)

Part of the Secure Coding: Authentication and Authorization domain, which makes up ~7% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 11–15

11foundation · easy
In an ASP.NET Core application, which authentication mechanism is most appropriate when the application needs to authenticate users against an existing Active Directory domain and automatically use the logged-in Windows user's identity?
Select an answer first
12expert · hard
A .NET application currently uses forms authentication with cookies. The security team wants to move to token-based authentication to support a mobile app. The application must also maintain session security. Which approach should be taken?
Select an answer first
13expert · hard
A .NET application uses claims-based authorization. A user's claims are issued at login and stored in the authentication cookie. The business now requires that some permissions be revocable immediately when a user's employment status changes. Which approach should be used?
Select an answer first
14expert · hard
A .NET application has implemented TOTP-based MFA. Users are reporting that they are being locked out of their accounts because their authenticator app and the server are out of sync (time drift). The application uses a strict time window of 30 seconds. What is the best way to handle this without compromising security?
Select an answer first
15foundation · easy
Which authorization strategy in ASP.NET Core is most appropriate when you need to restrict access to an action method to users who belong to the 'Administrator' role?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Authentication and Authorization Defensive Techniques CASENET Practice Questions (Page 3)

Questions 11–15

In an ASP.NET Core application, which authentication mechanism is most appropriate when the application needs to authenticate users against an existing Active Directory domain and automatically use the logged-in Windows user's identity?

A .NET application currently uses forms authentication with cookies. The security team wants to move to token-based authentication to support a mobile app. The application must also maintain session security. Which approach should be taken?

A .NET application uses claims-based authorization. A user's claims are issued at login and stored in the authentication cookie. The business now requires that some permissions be revocable immediately when a user's employment status changes. Which approach should be used?

Which authorization strategy in ASP.NET Core is most appropriate when you need to restrict access to an action method to users who belong to the 'Administrator' role?

Keep studying — Secure Coding: Authentication and Authorization