Secure Application Architecture CASENET Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which IAM component is primarily responsible for recording user activities for auditing and compliance purposes?

   • AAuthentication
   • BSingle Sign-On
   • CAccounting
   • DAuthorization
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A .NET application is deployed to Azure App Service. The development team uses connection strings with embedded credentials in the application settings. The security team wants to improve the security of secrets management. Which approach is most secure?

   • AEncrypt the connection strings using a custom encryption algorithm in the web.config.
   • BStore connection strings in a separate configuration file with restricted NTFS permissions.
   • CUse Azure Key Vault to store connection strings and reference them from App Service settings.
   • DUse environment variables in the App Service to store connection strings.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A .NET application stores credit card numbers in a SQL Server database. The company wants to reduce the risk of data exposure in case of a database breach and also wants to maintain the ability to process refunds. Which data protection strategy should be used?

   • AUse tokenization: store a token reference and keep the actual card numbers in a separate, highly secured vault.
   • BEncrypt the card numbers with AES-256 and store the key in the same database table.
   • CHash the card numbers with SHA-256 and store the hash.
   • DMask the card numbers in the database and store the full number in application logs.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A .NET web application uses cookie-based authentication. The security team discovers that after a user changes their password, the old session cookie remains valid. The application also allows users to view their own profile without re-authentication. Which architectural change best addresses the session management weakness?

   • AStore the session ID in a database and compare it with the user's password hash on every request.
   • BInvalidate all existing sessions for the user upon password change and require re-authentication for sensitive actions.
   • CShorten the session timeout to 5 minutes and use a longer random session ID.
   • DUse a fixed session ID for the user's lifetime and rotate it only on login.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A .NET application uses ASP.NET Core Identity for user management. The application has a role-based authorization requirement: only users with the 'Manager' role can approve expense reports. The current implementation checks the role in the controller action. Which improvement should be made?

   • ARely solely on the controller action check because it is sufficient.
   • BUse a custom middleware to check the role for every request.
   • CStore the user's role in a cookie and check it on the client side.
   • DApply an authorization filter or attribute at the controller or action level and also enforce the check in the business layer.
   Reveal Solution Discussion Select an answer first