A .NET application uses a custom authentication mechanism that stores user roles in a claims principal. The security team wants to ensure that role changes are reflected immediately when an administrator updates a user's role. Which approach should be used?

Store roles in a cookie that is updated only when the user logs in again.

Use a short-lived token and re-fetch roles from the database on each request.

Cache roles in memory for 24 hours.

Use a long-lived token with roles embedded in the claims.

A .NET application is being designed with a microservices architecture. The security architect wants to apply the principle of least privilege. Which approach best implements this principle?

Use a single service account for all microservices to simplify management.

Run all microservices under the same Windows service account.

Give each microservice its own service account with only the permissions required for its function.

Grant all microservices access to the entire database to avoid integration issues.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 7

Secure Application Architecture CASENET Practice Questions (Page 7)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 31–35

31foundation · easy
Which component of IAM is responsible for determining what an authenticated user is allowed to do within the application?
Select an answer first
32application · medium
A .NET application uses a custom authentication mechanism that stores user roles in a claims principal. The security team wants to ensure that role changes are reflected immediately when an administrator updates a user's role. Which approach should be used?
Select an answer first
33foundation · easy
Which data protection technique replaces sensitive data with a non-sensitive equivalent that has no exploitable value, but can be mapped back to the original value by authorized systems?
Select an answer first
34application · medium
A .NET application is being designed with a microservices architecture. The security architect wants to apply the principle of least privilege. Which approach best implements this principle?
Select an answer first
35foundation · easy
Which security principle ensures that if a component fails, the system does not grant access or expose sensitive data, but instead denies access by default?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Secure Application Architecture CASENET Practice Questions (Page 7)

Questions 31–35

Which component of IAM is responsible for determining what an authenticated user is allowed to do within the application?

A .NET application uses a custom authentication mechanism that stores user roles in a claims principal. The security team wants to ensure that role changes are reflected immediately when an administrator updates a user's role. Which approach should be used?

Which data protection technique replaces sensitive data with a non-sensitive equivalent that has no exploitable value, but can be mapped back to the original value by authorized systems?

A .NET application is being designed with a microservices architecture. The security architect wants to apply the principle of least privilege. Which approach best implements this principle?

Which security principle ensures that if a component fails, the system does not grant access or expose sensitive data, but instead denies access by default?

Keep studying — Security Requirements and Secure Design