Authentication and Authorization Defensive Techniques CASENET Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A .NET web application allows users to log in and then navigate to a secure area. After login, the application does not change the session ID. A penetration test reveals that an attacker can fixate the session ID before login and then use it after the victim authenticates. Which defensive technique should be applied to mitigate this?

   • ASet the session cookie to Secure and HttpOnly.
   • BRegenerate the session ID after successful authentication.
   • CStore the session ID in the URL instead of a cookie.
   • DUse a longer session timeout to keep the user logged in.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which authentication mechanism in ASP.NET Core is best suited for a REST API that needs to authenticate clients using a bearer token, such as a JSON Web Token (JWT)?

   • AForms Authentication
   • BWindows Authentication
   • CCertificate Authentication
   • DToken-based Authentication
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following is an example of a 'something you have' factor in multi-factor authentication?

   • AA one-time password generated by an authenticator app
   • BA fingerprint scan
   • CA security question answer
   • DThe user's password
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which secure error handling practice is important to prevent information disclosure that could aid an attacker in an authentication or authorization bypass?

   • ADisplaying stack traces to users for debugging
   • BSuppressing all error messages and logging nothing
   • CReturning generic error messages to users while logging detailed errors server-side
   • DLogging detailed errors to the client-side console
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A .NET application's login endpoint is being targeted by a brute-force attack. The current implementation has no lockout or rate limiting. Which combination of controls should be implemented to mitigate this?

   • AIncrease the password complexity requirements.
   • BOnly use a CAPTCHA on the login page.
   • CDisable the login endpoint for all users temporarily.
   • DImplement account lockout after a set number of failed attempts and add rate limiting on the login endpoint.
   Reveal Solution Discussion Select an answer first