Secure Application Architecture CASENET Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A .NET application uses a message queue to process orders. The security team is performing a threat model and identifies that an attacker could inject malicious messages into the queue, causing the order processing service to execute unintended actions. Which control should be prioritized?

   • AAuthenticate and authorize producers and consumers of the queue, and validate message schemas.
   • BLog all messages to an audit trail.
   • CUse a dead-letter queue to handle failed messages.
   • DEncrypt the messages in transit using TLS.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which protocol is the standard for encrypting HTTP traffic to protect data in transit between a web browser and a web server?

   • ASFTP
   • BSSH
   • CTLS
   • DIPsec
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In a layered application architecture, which layer is primarily responsible for enforcing authorization rules and orchestrating business operations?

   • ABusiness layer
   • BNetwork layer
   • CPresentation layer
   • DData layer
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A .NET API is consumed by a mobile app and a third-party partner. The API currently accepts requests with a static API key in the header. The security team wants to improve authentication and authorization. Which approach should be implemented?

   • AImplement OAuth 2.0 with client credentials for the partner and authorization code with PKCE for the mobile app.
   • BRequire the mobile app to send the user's password with each request for authentication.
   • CUse a longer, randomly generated API key and rotate it monthly.
   • DUse a shared secret signed with HMAC for both mobile and partner requests.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A .NET application is deployed using a CI/CD pipeline. The security team wants to ensure that production configuration secrets (e.g., connection strings, API keys) are not exposed in the source code repository. Which practice should be adopted?

   • AEmbed secrets in the web.config file and commit it to the repository.
   • BUse environment variables in the CI/CD pipeline and print them in build logs for debugging.
   • CStore secrets in a managed secrets vault (e.g., Azure Key Vault) and reference them at runtime.
   • DEncrypt the web.config file and store the encryption key in the same repository.
   Reveal Solution Discussion Select an answer first