A .NET API is publicly accessible and accepts JSON payloads. The API is behind an API gateway that enforces authentication and rate limiting. The development team wants to add an additional layer of protection against injection attacks. Which control should be implemented at the API layer?

Validate that all JSON fields match a strict schema and reject unknown fields.

Add a Web Application Firewall (WAF) rule to block requests containing SQL keywords.

Use parameterized queries or an ORM for all database operations.

Encode all output as HTML before returning it.

A .NET API is being integrated with a partner system. The partner will send requests to the API to retrieve order status. The security team requires that the API only accepts requests from the partner and that the partner cannot access other customers' data. Which combination of controls should be implemented?

Use OAuth 2.0 with a broad scope that grants access to all order data.

Use an API key in the header and enforce row-level authorization based on the partner's tenant ID.

Use client certificates for authentication but do not filter data by tenant.

Use a shared secret in the query string and allow any authenticated user to view all orders.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 7

Secure Application Architecture CASENET Practice Questions (Page 1)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 1–5

1expert · hard
A .NET API is publicly accessible and accepts JSON payloads. The API is behind an API gateway that enforces authentication and rate limiting. The development team wants to add an additional layer of protection against injection attacks. Which control should be implemented at the API layer?
Select an answer first
2foundation · easy
Which security design pattern is specifically used to prevent injection attacks by ensuring that user-supplied data is treated as data, not as executable code?
Select an answer first
3foundation · easy
Which security control is essential for an API to ensure that only authorized clients can access its endpoints?
Select an answer first
4foundation · easy
An application architecture uses multiple layers of security controls so that if one control fails, another still provides protection. Which security principle does this architecture exemplify?
Select an answer first
5application · medium
A .NET API is being integrated with a partner system. The partner will send requests to the API to retrieve order status. The security team requires that the API only accepts requests from the partner and that the partner cannot access other customers' data. Which combination of controls should be implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Secure Application Architecture CASENET Practice Questions (Page 1)

Questions 1–5

A .NET API is publicly accessible and accepts JSON payloads. The API is behind an API gateway that enforces authentication and rate limiting. The development team wants to add an additional layer of protection against injection attacks. Which control should be implemented at the API layer?

Which security design pattern is specifically used to prevent injection attacks by ensuring that user-supplied data is treated as data, not as executable code?

Which security control is essential for an API to ensure that only authorized clients can access its endpoints?

An application architecture uses multiple layers of security controls so that if one control fails, another still provides protection. Which security principle does this architecture exemplify?

Keep studying — Security Requirements and Secure Design