Authentication and Authorization in Web Forms, ASP.NET Core, and MVC CASENET Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In ASP.NET Core, which method is used to add cookie authentication services to the application's service collection?

   • AUseAuthentication().AddCookie()
   • BConfigure<CookieOptions>()
   • CAddAuthentication().AddCookie()
   • DAddMvc().AddCookie()
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An ASP.NET Core application uses cookie authentication. The security team requires that the authentication cookie be marked as HttpOnly to prevent access from client-side scripts. How should this be configured?

   • ASet Cookie.SecurePolicy = CookieSecurePolicy.Always.
   • BSet Cookie.Expiration to a short time.
   • CSet Cookie.SameSite = SameSiteMode.Strict.
   • DSet Cookie.HttpOnly = true in the CookieAuthenticationOptions.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Web Forms application uses Forms Authentication. The security team wants to implement account lockout to prevent brute-force attacks. However, they also want to avoid locking out legitimate users who may mistype their password a few times. What is the best approach?

   • AUse a longer password policy to make brute-force attacks harder.
   • BDo not implement lockout; instead, rely on CAPTCHA after a few failed attempts.
   • CLock the account permanently after the first failed attempt.
   • DLock the account for a short duration (e.g., 5 minutes) after a threshold of failed attempts (e.g., 5).
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company has an internal ASP.NET Core application where users can view and edit their own profile. The application uses cookie authentication. A developer is asked to ensure that a user cannot access another user's profile by manipulating the URL (e.g., /Profile/Edit/123). What is the most secure approach?

   • AUse a role-based authorization policy that allows any authenticated user to edit any profile.
   • BHide the Edit link from users who do not own the profile.
   • CUse [Authorize] on the Edit action to ensure the user is authenticated.
   • DIn the Edit action, verify that the profile ID belongs to the currently authenticated user before performing the update.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of implementing account lockout after multiple failed login attempts?

   • ATo improve user experience by preventing accidental lockouts
   • BTo prevent brute-force password guessing attacks
   • CTo reduce server load by limiting login requests
   • DTo comply with GDPR requirements
   Reveal Solution Discussion Select an answer first