Authentication and Authorization Defensive Techniques CASENET Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a recommended password hashing algorithm for securely storing passwords in a .NET application?

   • AMD5
   • BSHA-1
   • CAES
   • DPBKDF2
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A .NET application has a session timeout of 60 minutes. A security audit recommends reducing the risk of session hijacking. Which change should be made to the session configuration?

   • AUse a sliding expiration that resets on every request.
   • BReduce the session timeout to 15 minutes and implement an absolute timeout.
   • CDisable the session timeout entirely.
   • DIncrease the session timeout to 120 minutes to reduce user frustration.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A .NET application is being updated to support MFA. The current login flow only asks for username and password. The security team wants to require MFA for all users, but the help desk is concerned about users losing their phones. Which MFA strategy balances security and usability?

   • AUse SMS as the only MFA method.
   • BRequire MFA for all users, but provide backup codes that can be used once.
   • CAllow users to disable MFA after 30 days.
   • DRequire MFA only for administrators.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which technique is commonly used to limit the rate of requests to an authentication endpoint to mitigate brute-force attacks?

   • AInput validation
   • BOutput encoding
   • CRate limiting
   • DSecure error handling
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A .NET application stores user passwords in a database. The current implementation uses SHA-256 without salt. The security team has mandated a more secure password storage scheme. Which approach should you implement?

   • AUse SHA-512 with a global static salt.
   • BUse MD5 with a per-user salt.
   • CUse PBKDF2 with a per-user random salt and a high iteration count.
   • DUse AES encryption with a hardcoded key.
   Reveal Solution Discussion Select an answer first