Secure Application Architecture CASENET Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A .NET application is deployed on Azure VMs. The application communicates with an on-premises database over the internet using SQL Server authentication with a username and password. The security team wants to secure the communication and the credentials. Which solution is most appropriate?

   • ASet up a site-to-site VPN or ExpressRoute between Azure and the on-premises network, and use Azure Key Vault to store the SQL credentials.
   • BUse a jump server with RDP to access the database and run queries manually.
   • COpen the SQL Server port to the internet and use IPsec for encryption.
   • DUse SSL/TLS for the SQL connection and store the password in the application's web.config.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of using a certificate from a trusted Certificate Authority (CA) in a TLS connection?

   • ATo compress the data for faster transmission
   • BTo provide a backup of the server's private key
   • CTo encrypt the data being transmitted
   • DTo authenticate the server's identity to the client
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A .NET application is deployed using Docker containers on a Kubernetes cluster. The security team wants to ensure that the application's configuration secrets are not exposed in the container image or in environment variables that can be viewed by anyone with pod access. Which approach should be used?

   • AUse a dedicated secrets management solution like HashiCorp Vault or Azure Key Vault with a sidecar or CSI driver.
   • BUse Kubernetes Secrets mounted as volumes or injected as environment variables, and enable encryption at rest for etcd.
   • CEmbed secrets directly in the Dockerfile using ARG and ENV instructions.
   • DStore secrets in a config map and reference them in the deployment manifest.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A .NET application is deployed using Azure DevOps pipelines. The pipeline builds the application, runs unit tests, and deploys to Azure App Service. The security team wants to integrate security scanning into the pipeline. Which approach is most effective?

   • APerform manual code reviews instead of automated scanning.
   • BAdd static application security testing (SAST) to the build stage, dependency scanning, and dynamic application security testing (DAST) against a staging environment.
   • CRun DAST only in production after deployment.
   • DUse only SAST and skip dependency scanning because it is not necessary.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A .NET web application has a global exception handler that returns a generic error page. The development team wants to log detailed error information for troubleshooting without exposing it to users. Which pattern should be implemented?

   • AShow the exception message only to users in the 'Developer' role.
   • BReturn the exception stack trace directly in the HTTP response.
   • CLog exception details to a secure logging service and return a generic message to the user.
   • DDisable all error logging to avoid storing sensitive information.
   Reveal Solution Discussion Select an answer first