Authentication and Authorization in Web Forms, ASP.NET Core, and MVC CASENET Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In a typical ASP.NET MVC application, which component is responsible for handling user login and logout?

   • AHomeController
   • BStartup.cs
   • CAccountController
   • DGlobal.asax
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In ASP.NET MVC, which attribute can be applied to a controller or action to require that the user is authenticated?

   • A[OutputCache]
   • B[RequireHttps]
   • C[Authorize]
   • D[ValidateInput]
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An MVC application has a custom authorization filter that checks if the user has a specific permission. The filter is applied to a controller. However, the filter is not being executed for some actions. What is the most likely cause?

   • AThe filter is registered as a global filter, but the controller has a filter override.
   • BThe actions are decorated with [AllowAnonymous], which bypasses authorization filters.
   • CThe filter is applied to the controller but the actions are in a different controller.
   • DThe filter is defined in the wrong namespace.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A Web Forms application currently uses Forms Authentication with a cookie. The security team wants to ensure that the authentication cookie is not accessible via client-side script. What should be configured?

   • AUse the <forms> element's protection attribute set to Encryption.
   • BSet the sameSite attribute to Strict in the <httpCookies> element.
   • CSet the requireSSL attribute to true in the <httpCookies> element.
   • DSet the httpOnlyCookies attribute to true in the <httpCookies> element in web.config.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   An ASP.NET Core MVC application has a controller action that allows users to view their own orders. The action currently uses [Authorize] and then fetches the order by an ID passed in the query string. A penetration test revealed that a user can view another user's order by changing the ID. What is the best fix?

   • AAdd [Authorize(Roles = "User")] to the action to ensure only authenticated users can access it.
   • BEncrypt the order ID in the query string to prevent tampering.
   • CIn the action, verify that the order belongs to the current user before returning it; if not, return NotFound.
   • DUse a custom authorization filter that checks if the user is in the 'Admin' role.
   Reveal Solution Discussion Select an answer first