Authentication and Authorization in Web Forms, ASP.NET Core, and MVC CASENET Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which security principle states that a user should be granted only the minimum permissions necessary to perform their job functions?

   • ADefense in depth
   • BSeparation of duties
   • CLeast privilege
   • DFail secure
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An ASP.NET Core application uses JWT bearer authentication. The tokens are issued by an external identity provider. The application needs to ensure that tokens are only accepted if they were issued for this specific audience. What is the correct configuration?

   • ARely on the identity provider to only issue tokens to the correct audience.
   • BUse [Authorize(Audience = "your-api")] on the controllers.
   • CSet TokenValidationParameters.ValidIssuer to the identity provider's URL.
   • DSet TokenValidationParameters.ValidAudience to the expected audience value in the JwtBearer options.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A Web Forms application uses Forms Authentication. The application has a page that is accessible to all authenticated users, but a specific button on the page should only be visible to users in the 'Editor' role. What is the most secure way to implement this?

   • AUse CSS to hide the button from non-Editors.
   • BCheck User.IsInRole("Editor") in the code-behind and only render the button if true.
   • CUse JavaScript to check the user's role and hide the button.
   • DOnly render the button if the user is in the Editor role, and also protect the server-side action with URL authorization or role checks.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An ASP.NET Core application needs to support both cookie authentication for MVC views and JWT bearer authentication for Web API endpoints. What is the correct way to configure this?

   • ACall AddAuthentication() and then AddCookie() and AddJwtBearer(), and set the default scheme to one of them.
   • BUse only JWT bearer authentication and store the token in a cookie for MVC views.
   • CUse only cookie authentication and manually parse the JWT in the API controllers.
   • DCreate two separate applications, one for MVC and one for the API.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In ASP.NET Web Forms, which configuration element allows you to restrict access to specific files or folders based on the authenticated user's role?

   • A<authentication>
   • B<identity>
   • C<authorization>
   • D<sessionState>
   Reveal Solution Discussion Select an answer first