What is the primary purpose of encrypting data at rest in a database?

To protect data from unauthorized access if the storage medium is compromised

To prevent SQL injection attacks

A team is designing a new .NET REST API that will be exposed to external partners. During a threat modeling session, they identify that an attacker could send a large number of requests with deeply nested JSON payloads to exhaust server resources. Which control should be prioritized to mitigate this specific threat?

Use HTTPS for all API communications.

Require OAuth 2.0 client credentials for every request.

Log all requests to an audit store for later analysis.

Implement request size limits and depth validation on the JSON deserializer.

A .NET application uses Azure AD B2C for customer authentication. The application has both a web app and a mobile app. The security team wants to implement single sign-on (SSO) across both apps. They also need to support social logins (Google, Facebook). Which approach should be used?

Use separate identity providers for each app to avoid complexity.

Use Azure AD (workforce) instead of B2C because it supports social logins.

Use Azure AD B2C as the identity provider and configure both apps to use the same B2C tenant with appropriate redirect URIs.

Implement a custom identity server with social login integration.

Why is it important to include security checks in the continuous integration/continuous deployment (CI/CD) pipeline?

To replace the need for manual code reviews

To ensure the application is always available

To automate the detection of vulnerabilities early in the development lifecycle

Which practice is essential for maintaining a secure architecture during deployment?

Disabling logging to save resources

Using default configuration settings

Deploying directly to production without testing

Hardening the server and application configuration

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 7

Secure Application Architecture CASENET Practice Questions (Page 5)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 21–25

21foundation · easy
What is the primary purpose of encrypting data at rest in a database?
Select an answer first
22application · medium
A team is designing a new .NET REST API that will be exposed to external partners. During a threat modeling session, they identify that an attacker could send a large number of requests with deeply nested JSON payloads to exhaust server resources. Which control should be prioritized to mitigate this specific threat?
Select an answer first
23expert · hard
A .NET application uses Azure AD B2C for customer authentication. The application has both a web app and a mobile app. The security team wants to implement single sign-on (SSO) across both apps. They also need to support social logins (Google, Facebook). Which approach should be used?
Select an answer first
24foundation · easy
Why is it important to include security checks in the continuous integration/continuous deployment (CI/CD) pipeline?
Select an answer first
25foundation · easy
Which practice is essential for maintaining a secure architecture during deployment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.