Secure Application Architecture CASENET Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A .NET web application uses session-based authentication. The security team wants to prevent session fixation attacks. Which combination of controls should be implemented?

   • ASet the session cookie to expire after 30 days.
   • BStore the session ID in a JavaScript variable and send it in the URL.
   • CRegenerate the session ID after login and set the session cookie with Secure and HttpOnly flags.
   • DUse a fixed session ID for the user's lifetime and rely on HTTPS.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A healthcare .NET application stores patient records in a SQL Server database. The compliance team requires that patient data be unreadable if the database files are stolen, but the application must still be able to search by patient name. The data is currently stored in plaintext. Which data protection strategy should the architect implement?

   • AEncrypt the entire database with BitLocker and use a hardware security module (HSM) for keys.
   • BUse column-level encryption for sensitive fields and store the encryption keys in Azure Key Vault.
   • CApply Transparent Data Encryption (TDE) to the entire database and rely on the operating system's file permissions.
   • DHash all patient names and store the hash for search, while encrypting the rest of the record.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A .NET application has a three-tier architecture: presentation, business, and data. The threat model identifies that a SQL injection vulnerability exists in the data layer. The business layer also trusts the presentation layer for authorization decisions. The security team must implement a fix. Which approach best addresses the root cause?

   • AUse parameterized queries in the data layer and enforce authorization checks in the business layer.
   • BAdd a WAF to filter malicious input and rely on the presentation layer for authorization.
   • CUse stored procedures and validate input only in the presentation layer.
   • DEncrypt the database and use ORM without parameterization.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   In the STRIDE threat model, which threat category involves an attacker reading data that they are not authorized to access?

   • ASpoofing
   • BInformation disclosure
   • CTampering
   • DDenial of service
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A .NET application communicates with a third-party payment gateway over the internet. The payment gateway supports TLS 1.2 and TLS 1.3. The security policy requires that all data in transit be encrypted and that the connection resist downgrade attacks. What should the architect configure?

   • AUse HttpClient with a handler that enforces TLS 1.2 or higher and validates the server certificate.
   • BUse HttpClient with the default TLS settings and ignore certificate errors for convenience.
   • CUse a raw TCP socket and implement custom encryption in the application layer.
   • DUse HTTP with a shared secret in the request header.
   Reveal Solution Discussion Select an answer first