An ASP.NET Core application uses JWT bearer authentication. They need to restrict access to an API endpoint to users who have a claim 'Department' with value 'Engineering'. What is the most appropriate way to enforce this?

Configure the JWT bearer middleware to reject tokens without the Department claim.

Use [Authorize] and then manually inspect the JWT payload in the action method.

Use a policy with a requirement that checks the claim type and value, then apply [Authorize(Policy = "EngineeringOnly")] to the endpoint.

Add [Authorize(Roles = "Engineering")] to the endpoint.

A Web Forms application uses Forms Authentication. The security team is concerned about session fixation attacks. What is the most effective mitigation?

Set the session timeout to a very short value, like 1 minute.

Store the session ID in a hidden form field instead of a cookie.

Regenerate the session ID after successful login and use a new authentication cookie.

Use a static session ID for all users to simplify management.

Which authentication scheme in ASP.NET Core is commonly used for securing a REST API with a bearer token?

External provider authentication

EC-CouncilCertified Application Security Engineer (.NET)

Domain 4Objective 2

Authentication and Authorization in Web Forms, ASP.NET Core, and MVC CASENET Practice Questions (Page 4)

Part of the Secure Coding: Authentication and Authorization domain, which makes up ~7% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

8concepts

Questions 16–20

16application · medium
An ASP.NET Core application uses JWT bearer authentication. They need to restrict access to an API endpoint to users who have a claim 'Department' with value 'Engineering'. What is the most appropriate way to enforce this?
Select an answer first
17foundation · easy
Which ASP.NET Web Forms authentication mode is most appropriate for an intranet application where users are already logged into the corporate Windows domain?
Select an answer first
18application · medium
A Web Forms application uses Forms Authentication. The security team is concerned about session fixation attacks. What is the most effective mitigation?
Select an answer first
19foundation · easy
Which authentication scheme in ASP.NET Core is commonly used for securing a REST API with a bearer token?
Select an answer first
20foundation · easy
In ASP.NET Web Forms, which authentication mode uses an encrypted cookie to store the user's identity and is configured in the web.config file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Authentication and Authorization in Web Forms, ASP.NET Core, and MVC CASENET Practice Questions (Page 4)

Questions 16–20

An ASP.NET Core application uses JWT bearer authentication. They need to restrict access to an API endpoint to users who have a claim 'Department' with value 'Engineering'. What is the most appropriate way to enforce this?

Which ASP.NET Web Forms authentication mode is most appropriate for an intranet application where users are already logged into the corporate Windows domain?

A Web Forms application uses Forms Authentication. The security team is concerned about session fixation attacks. What is the most effective mitigation?

Which authentication scheme in ASP.NET Core is commonly used for securing a REST API with a bearer token?

In ASP.NET Web Forms, which authentication mode uses an encrypted cookie to store the user's identity and is configured in the web.config file?

Keep studying — Secure Coding: Authentication and Authorization