Authentication and Authorization in Web Forms, ASP.NET Core, and MVC CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An ASP.NET Core MVC application has a controller action that should be accessible only to users who have completed a mandatory training module. The training completion is stored as a claim 'TrainingCompleted' with value 'True'. Which authorization approach best fits this requirement?

   • AUse [AllowAnonymous] and check the claim inside the action method.
   • BConfigure the cookie authentication middleware to only issue cookies to users with the claim.
   • CAdd [Authorize(Roles = "Trained")] and ensure users are placed in the 'Trained' role after completing training.
   • DCreate a custom authorization policy that requires the claim 'TrainingCompleted' with value 'True' and apply it with [Authorize(Policy = "TrainingRequired")].
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Web Forms application uses Forms Authentication with a custom login page. The security team wants to mitigate brute-force attacks on user accounts. Which combination of measures is most effective?

   • AUse a longer session timeout to keep users logged in longer.
   • BStore passwords in plain text in the database for faster verification.
   • CDisable SSL/TLS to reduce latency on login requests.
   • DImplement account lockout after a threshold of failed attempts and use a delay between login attempts.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which type of authorization in ASP.NET Web Forms uses the file system permissions (ACLs) to determine if a user can access a resource?

   • ARole-based authorization
   • BFile authorization
   • CURL authorization
   • DClaim-based authorization
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An ASP.NET Core application uses cookie authentication. The security team wants to prevent session fixation attacks. Which configuration should be used?

   • ASet the cookie's ExpireTimeSpan to a very short duration, such as 5 minutes.
   • BUse a static session ID that is derived from the user's username.
   • CEnsure that the authentication cookie is regenerated after login by using the default behavior of the cookie authentication middleware.
   • DStore the session ID in a JavaScript variable and send it in the URL.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer is implementing password storage for an ASP.NET Core application. The security policy requires that passwords be stored in a way that resists brute-force attacks even if the database is compromised. What should the developer use?

   • AEncrypt passwords using AES and store the key in the web.config.
   • BHash passwords with SHA-256 and a global salt.
   • CUse ASP.NET Core Identity's PasswordHasher, which uses PBKDF2 with a per-user salt.
   • DStore passwords in plain text and rely on database security.
   Reveal Solution Discussion Select an answer first