Authentication and Authorization Defensive Techniques CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A .NET application stores user passwords using the SHA-256 algorithm without a salt. The security team requires a more secure password storage mechanism. Which approach should be adopted?

   • AUse a strong adaptive hashing algorithm like PBKDF2 with a unique salt per user.
   • BUse SHA-256 with a global salt appended to all passwords.
   • CEncrypt the passwords using AES-256 with a static key stored in the web.config.
   • DStore the passwords in a separate database with restricted access.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A .NET web application currently uses forms authentication with cookies. The security team wants to ensure that authentication cookies are not accessible to client-side scripts and are only sent over HTTPS. Which configuration should be applied?

   • AStore the authentication ticket in the session instead of a cookie.
   • BUse a shorter session timeout.
   • CSet the HttpOnly and Secure flags on the authentication cookie.
   • DSet the SameSite attribute to Lax.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A .NET application has different types of users: regular users, managers, and administrators. The authorization logic currently uses if-else checks on the user's role string in every controller action. The code is becoming hard to maintain and error-prone. Which approach should be used to centralize and enforce authorization?

   • ACreate a custom base controller that checks the role in the OnActionExecuting method.
   • BStore the role in a session variable and check it in the view.
   • CUse a global filter that logs all user roles.
   • DUse [Authorize(Roles = "Administrator")] attributes on controllers and actions.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A .NET application's login page displays detailed error messages such as 'User does not exist' or 'Password incorrect'. This information could be used by attackers to enumerate valid usernames. Which defensive technique should be applied?

   • ARedirect to a generic error page after any failed login.
   • BReturn a generic error message for both invalid username and invalid password.
   • CLog the detailed error messages to the event log only.
   • DUse a CAPTCHA on the login page.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of implementing an account lockout policy in an authentication system?

   • ATo encrypt the password in the database
   • BTo ensure users change their passwords regularly
   • CTo prevent users from sharing their accounts
   • DTo mitigate brute-force attacks by limiting the number of failed login attempts
   Reveal Solution Discussion Select an answer first