Secure Application Architecture CASENET Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A .NET API uses OAuth 2.0 with the authorization code flow. The API is a resource server that validates access tokens. The security team wants to ensure that a compromised client application cannot access another client's data. Which control should be implemented?

   • AUse the 'aud' claim in the access token to verify that the token was issued for this specific API.
   • BUse the same client ID for all applications to simplify management.
   • CStore access tokens in a shared cookie to reduce overhead.
   • DRely on the client secret to authenticate the user.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A .NET web application is deployed behind an Azure Application Gateway. The application uses HTTP for internal service-to-service calls between the web tier and the business tier. The security team wants to ensure all traffic is encrypted. What should be configured?

   • AEnable HTTPS on the Application Gateway and use HTTPS for all internal service calls with mutual TLS where possible.
   • BUse IPsec on the virtual network to encrypt all traffic between tiers.
   • CRely on the internal network being isolated with network security groups (NSGs).
   • DUse a VPN between the web tier and business tier to encrypt traffic.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A .NET e-commerce application uses a three-tier architecture. During a threat modeling session, the team identifies that the presentation layer directly constructs SQL queries using user-supplied search text, and the business layer trusts the presentation layer's user ID without re-authentication. The data layer stores credit card numbers in plaintext. Which combination of security controls should the architect prioritize to address the most critical risks across all layers?

   • AMove all business logic to the presentation layer to reduce the attack surface, and use stored procedures for database access.
   • BImplement role-based access control (RBAC) in the presentation layer, and use transparent data encryption (TDE) for the database.
   • CImplement parameterized queries in the data layer, enforce re-authentication for sensitive operations in the business layer, and encrypt credit card data at rest.
   • DAdd a Web Application Firewall (WAF) in front of the presentation layer, use HTTPS for all client communications, and apply disk-level encryption to the database server.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of validating input in an API endpoint?

   • ATo improve network latency
   • BTo encrypt the data in transit
   • CTo prevent injection attacks and other malicious payloads
   • DTo authenticate the client
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which security design pattern is most effective in preventing sensitive information leakage through verbose error messages?

   • ASession management
   • BOutput encoding
   • CSecure error handling
   • DInput validation
   Reveal Solution Discussion Select an answer first