Authentication and Authorization in Web Forms, ASP.NET Core, and MVC CASENET Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which attribute in ASP.NET MVC allows you to restrict access to a controller action to users in a specific role?

   • A[ValidateAntiForgeryToken]
   • B[AllowAnonymous]
   • C[Authorize(Roles = "Admin")]
   • D[Authorize(Users = "Admin")]
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An ASP.NET Web Forms application uses Forms Authentication. They need to allow only users in the 'Sales' role to access a specific page, but also allow users in the 'Manager' role. What is the correct authorization rule?

   • A<deny users="*" /> and <allow roles="Sales" /> only.
   • B<allow roles="Sales" /> and <allow roles="Manager" /> without a deny rule.
   • C<allow users="*" /> and <deny roles="Sales" />.
   • D<allow roles="Sales,Manager" /> and <deny users="*" /> in the page's location element.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company runs an ASP.NET Web Forms application on IIS. They need to allow only users in the 'Sales' role to access the /Reports folder, while all authenticated users can access the rest of the site. They currently use Forms Authentication with a custom role provider. What is the most appropriate way to enforce this restriction?

   • AAdd a <location> element in web.config that sets <authorization> to allow the 'Sales' role and deny all other users for the /Reports path.
   • BPlace a check in the Page_Load event of each page in /Reports that redirects users not in the 'Sales' role to the login page.
   • CSet the <authentication> mode to 'Windows' and rely on NTFS file permissions to restrict the folder.
   • DUse the <authorization> element in the root web.config to deny all users, then add a separate <allow> for the Sales role in the /Reports web.config.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is an example of implementing separation of duties in an application?

   • AAllowing a user to both create and approve purchase orders
   • BUsing a single admin account for all administrative tasks
   • CGranting all users the same level of access
   • DRequiring two different users to create and approve a purchase order
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a secure practice for storing user passwords in a database?

   • AUse a one-way hash with a unique salt per user
   • BUse a simple MD5 hash without salt
   • CEncrypt passwords with a symmetric key
   • DStore passwords in plain text
   Reveal Solution Discussion Select an answer first