Authentication and Authorization in Web Forms, ASP.NET Core, and MVC CASENET Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An ASP.NET Core application uses policy-based authorization. They have a policy 'CanEdit' that requires the user to have a claim 'Permission' with value 'Edit' OR be in the 'Admin' role. They want to implement this policy. What is the correct way to define it?

   • AUse a custom requirement handler that checks both conditions and returns success if either is true.
   • BCreate two separate policies and apply both to the controller.
   • CUse the policy builder's RequireClaim and RequireRole methods together.
   • DUse [Authorize(Roles = "Admin")] and [Authorize(Policy = "CanEdit")] together.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An ASP.NET Core application uses policy-based authorization. They have a policy 'Over18' that requires a claim 'DateOfBirth' and checks that the user is at least 18 years old. They want to apply this policy to a Razor Page. What is the correct way to do this?

   • AUse the [Authorize(Policy = "Over18")] attribute on the Razor Page's @page directive or the PageModel class.
   • BAdd a global authorization filter that requires the Over18 policy for all pages.
   • CCheck the policy manually in the OnGet method and return a redirect if not satisfied.
   • DUse the [Authorize(Roles = "Over18")] attribute instead.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which attribute in ASP.NET Core allows you to restrict access to a controller action based on a specific claim?

   • A[Authorize(Policy = "ClaimPolicy")]
   • B[ValidateAntiForgeryToken]
   • C[Authorize]
   • D[AllowAnonymous]
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An ASP.NET Core application uses cookie authentication. After a user changes their password, the application should invalidate all existing sessions immediately. What is the most effective way to achieve this?

   • AUse the SecurityStampValidator to validate the security stamp on each request and call UpdateSecurityStampAsync when the password changes.
   • BClear the browser cache on the client side after password change.
   • CDelete the user's row from the database to force re-authentication.
   • DSet the cookie's Expires property to a past date after password change.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A developer is building an ASP.NET Core application that uses cookie authentication. The security policy requires that the authentication cookie be protected from cross-site request forgery (CSRF) and be transmitted only over HTTPS. What should the developer configure?

   • ASet Cookie.SecurePolicy = CookieSecurePolicy.Always and use the built-in anti-forgery token validation in forms.
   • BSet Cookie.HttpOnly = true and Cookie.SameSite = Strict.
   • CUse JWT bearer tokens instead of cookies to avoid CSRF.
   • DSet Cookie.Expiration to a short time and use sliding expiration.
   Reveal Solution Discussion Select an answer first