Authentication and Authorization Defensive Techniques CASENET Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is deploying a .NET application that will be accessed by employees from both corporate devices and personal devices. The security policy requires that all access be protected with MFA. Which MFA method would be most appropriate for this mixed-device environment?

   • AUse SMS-based one-time passwords sent to the user's phone.
   • BUse a TOTP-based authenticator app that works on any smartphone.
   • CUse hardware security keys that are issued only to corporate devices.
   • DUse biometric authentication only on corporate devices.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A .NET application has an authentication endpoint that returns different HTTP status codes for different failure reasons: 404 for unknown username, 401 for wrong password, and 403 for locked account. A security audit flags this as a user enumeration vulnerability. Which change should be made?

   • ALog the specific failure reason to the server logs and return a generic 500 error.
   • BUse a custom header to indicate the failure reason.
   • CReturn the same HTTP status code (e.g., 401) for all authentication failures.
   • DReturn a 200 status code with a generic error message in the body.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A .NET application uses cookies for session management. The application is behind a load balancer that terminates SSL. The security team wants to ensure that session cookies are not transmitted over plain HTTP. Which configuration should be used?

   • AStore the session ID in the URL instead of a cookie.
   • BSet the Secure flag on the session cookie and ensure the application is configured to trust the load balancer's X-Forwarded-Proto header.
   • CSet the HttpOnly flag on the session cookie.
   • DUse a shorter session timeout.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of adding a unique salt to each user's password before hashing?

   • ATo make the password longer and harder to guess
   • BTo allow the password to be recovered if forgotten
   • CTo encrypt the password in the database
   • DTo prevent the use of rainbow table attacks
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A .NET MVC application uses forms authentication. After a user logs in, the application stores the user's role in a session variable and checks it on each request to decide whether to allow access to admin pages. A security review flags this as risky. Which change should the developer implement to improve authorization security?

   • AStore the role in a cookie and read it in the controller to avoid session lookups.
   • BUse Windows authentication and rely on the built-in role provider to map users to roles.
   • CUse a claims-based identity and issue the role as a claim in the authentication ticket, then use role claims in authorization attributes.
   • DKeep the role in the session but also validate it against the database on each request.
   Reveal Solution Discussion Select an answer first