Secure Application Architecture CASENET Practice Questions (Page 11)

Questions 51–54

1. 51foundation · easy

   Which security control is most appropriate to implement in the data layer of an application to protect sensitive data stored in a database?

   • AInput validation
   • BEncryption at rest
   • COutput encoding
   • DSession timeout
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A .NET application has a three-tier architecture: presentation, business, and data. The security team wants to ensure that a compromise in the presentation layer does not directly lead to a compromise of the data layer. Which architectural control is most effective?

   • AAllow direct database access from the presentation layer for performance.
   • BUse the same service account for all three tiers to simplify management.
   • CEncrypt all data in the database with a key stored on the web server.
   • DPlace the data layer on a separate network segment with firewall rules that only allow traffic from the business layer.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A .NET mobile app backend uses a REST API over HTTPS. The security team wants to ensure that the API cannot be replayed by an attacker who intercepts the traffic. Which mechanism should be added to the API design?

   • ARely on HTTPS to prevent interception.
   • BInclude a nonce or timestamp in each request and validate it on the server.
   • CUse CORS to restrict the origin of requests.
   • DUse a long-lived bearer token in the Authorization header.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A .NET web application uses ASP.NET Core Identity for user authentication. The application has an admin area that should only be accessible to users with the 'Administrator' role. The architect wants to enforce this at the architectural level, not just in the UI. Which approach should be used?

   • AUse a custom middleware that checks the URL path for '/admin' and verifies the role.
   • BCheck the user's role only in the admin view's Razor code.
   • CHide the admin menu items from non-admin users in the layout view.
   • DApply an [Authorize(Roles = "Administrator")] attribute to the admin controllers.
   Reveal Solution Discussion Select an answer first