Secure Application Architecture CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A .NET Web API is exposed to external partners. The API accepts JSON payloads and processes them. The security team wants to protect the API from malicious payloads. Which set of controls should be implemented?

   • AValidate the JSON schema, set a maximum request size, and use model validation attributes.
   • BUse a third-party JSON parser without any configuration.
   • CDisable model validation to improve performance.
   • DOnly accept XML payloads because they are safer.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During a threat modeling exercise for a .NET application, the team uses STRIDE to categorize threats. They identify that an attacker could tamper with a financial transaction amount by intercepting and modifying the request between the client and server. Which STRIDE category does this threat belong to, and what is the most appropriate mitigation?

   • AInformation disclosure; mitigate by encrypting the data at rest.
   • BDenial of service; mitigate by rate limiting the API.
   • CSpoofing; mitigate by implementing strong authentication.
   • DTampering; mitigate by using HTTPS with integrity checks and signing the request payload.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A .NET application processes highly sensitive financial data. The architecture uses a single web server with a local database. The security architect wants to apply defense in depth. Which set of controls best exemplifies this principle?

   • AEncrypt the database and use a complex encryption key.
   • BUse network segmentation, a WAF, application-level input validation, encrypted database storage, and least-privilege service accounts.
   • CRely on a strong password policy and HTTPS.
   • DUse a single firewall and antivirus software.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A .NET MVC application has a global error handler that returns detailed exception messages to users. The security team wants to implement a secure error handling pattern. Which approach should be used?

   • AUse a custom error page that shows the exception type only.
   • BReturn the exception message directly to the user for transparency.
   • CLog detailed exceptions server-side and return generic error messages to users.
   • DDisable all error handling to avoid exposing information.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A .NET application stores credit card numbers for recurring payments. The PCI DSS requirement is to render the PAN unreadable anywhere it is stored. The application also needs to display the last four digits to users. Which strategy should be used?

   • AUse tokenization: replace the PAN with a token and store the actual PAN in a separate, highly secured vault.
   • BHash the PAN with a salt and store the hash.
   • CTruncate the PAN to the last four digits and store only that.
   • DEncrypt the PAN with a strong algorithm and store the key in the same database.
   Reveal Solution Discussion Select an answer first