Authentication and Authorization in Web Forms, ASP.NET Core, and MVC CASENET Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An ASP.NET Core application needs to support both cookie authentication for its MVC views and JWT bearer authentication for its Web API. The application has a single login endpoint that issues both a cookie and a JWT. What is the correct way to configure authentication?

   • AUse only cookie authentication and store the JWT in a cookie as well.
   • BCreate two separate applications, one for MVC and one for API.
   • CUse only JWT bearer authentication and store the token in a cookie for MVC views.
   • DAdd both AddAuthentication().AddCookie() and AddJwtBearer() in Startup, and use [Authorize] on controllers with appropriate authentication schemes.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An ASP.NET Web Forms application uses Forms Authentication. The application has an Admin folder that should only be accessible to users in the 'Admin' role. Currently, the web.config in the Admin folder has <allow roles="Admin" />. What else must be configured to ensure that only Admin users can access the folder?

   • ASet the <authorization> element to <allow roles="Admin" /> and <deny users="?" />.
   • BSet the <authentication> mode to 'Windows' in the Admin folder's web.config.
   • CAdd <deny users="*" /> to the same <authorization> element in the Admin folder's web.config.
   • DAdd a <location> element in the root web.config to allow Admin role for the Admin folder.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An MVC application has a controller action that is accessible to both authenticated users and anonymous users, but the action returns different data based on the user's role. The team wants to ensure that anonymous users cannot access data meant for authenticated users. What is the most secure approach?

   • AUse [Authorize(Roles = "User,Admin")] and also allow anonymous via a separate action.
   • BUse [Authorize] on the action and handle anonymous users by redirecting them to a login page.
   • CUse [AllowAnonymous] on the action and in the action method check User.Identity.IsAuthenticated and User.IsInRole to return appropriate data.
   • DUse a custom authorization filter that returns a 403 for anonymous users.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An MVC application has a custom authorization filter that checks if the current user has a specific permission. The filter is applied to multiple controllers. The team wants to ensure that the permission check is consistent and maintainable. What is the best approach?

   • ACopy the permission check code into each action method.
   • BPerform the permission check in the view and hide unauthorized links.
   • CCreate a custom AuthorizeAttribute that encapsulates the permission check and apply it to the controllers.
   • DUse a global filter that applies the permission check to all actions, including public ones.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In ASP.NET Core, which method is used to register an authorization policy that can be applied to controllers or actions?

   • AAddAuthorization().AddPolicy()
   • BUseAuthorization().AddPolicy()
   • CAddPolicy()
   • DAddAuthorization()
   Reveal Solution Discussion Select an answer first