Authentication and Authorization Defensive Techniques CASENET Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A public-facing ASP.NET application has been experiencing brute-force attacks on its login page. The attackers are rotating IP addresses to avoid simple IP-based lockout. The application must slow down automated attacks without affecting legitimate users. Which strategy is most effective?

   • AUse a CAPTCHA after a few failed attempts from the same IP address.
   • BImplement account lockout after 5 failed attempts for 15 minutes.
   • CImplement progressive delays (rate limiting) on the login endpoint per user account and per IP, with exponential backoff.
   • DRequire MFA for all users.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A .NET application has a legacy password hash database using unsalted MD5. The security team wants to upgrade to a secure hashing algorithm without forcing all users to reset their passwords immediately. What is the best migration strategy?

   • AStore both MD5 and PBKDF2 hashes and validate against either.
   • BOn next successful login, rehash the password with PBKDF2 and a new salt, then update the database.
   • CForce all users to reset their passwords immediately.
   • DConvert all MD5 hashes to PBKDF2 by re-hashing the MD5 hash.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An ASP.NET application has a login endpoint that is vulnerable to credential stuffing attacks, where attackers use lists of usernames and passwords from other breaches. The application currently has no rate limiting. What is the most effective control to add?

   • AImplement IP-based rate limiting (e.g., 10 attempts per minute).
   • BImplement per-account rate limiting and require MFA for suspicious logins.
   • CImplement account lockout after 3 failed attempts.
   • DAdd a CAPTCHA to the login form.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary security benefit of implementing multi-factor authentication (MFA) in an application?

   • AIt prevents all types of phishing attacks
   • BIt eliminates the need for password complexity policies
   • CIt ensures the user is accessing from a trusted device
   • DIt adds an additional layer of security beyond just the username and password
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A .NET MVC application uses forms authentication with cookies. After a successful login, the user is redirected to a page that displays sensitive data. The security team notices that if a user copies the authentication cookie from one browser to another on a different machine, the session remains valid. The application must prevent this. What should you configure?

   • AUse a custom authentication cookie that includes a hash of the user agent and a server-side session tied to the original browser fingerprint.
   • BStore the session identifier in a cookie and validate the user's IP address on each request.
   • CSet the cookie's HttpOnly and Secure flags, and enable sliding expiration.
   • DUse a session ID that is regenerated after login and store it in a cookie with SameSite=Strict.
   Reveal Solution Discussion Select an answer first