A .NET web application is hosted on IIS and communicates with a backend API over the network. The security team requires that all communication be encrypted. Which protocol should be enforced?

FTP for file transfers between servers.

HTTP with basic authentication.

SSL 3.0 for compatibility with older clients.

TLS 1.2 or higher for both the web and API endpoints.

A .NET application is deployed to production. The security team wants to detect and respond to security incidents during and after deployment. Which monitoring and logging mechanism should be implemented?

Configure Windows Event Log to store only application errors.

Use a packet sniffer to capture all network traffic to the server.

Enable .NET tracing to log all application method calls.

Enable IIS logging and configure a SIEM tool to collect and analyze the logs.

A .NET application uses a custom authentication scheme. The security team requires that authentication be secure, but the application must also support legacy clients that cannot use modern protocols. What is the best approach?

Use basic authentication over HTTP for legacy clients.

Use a custom header with a shared secret for legacy clients.

Disable authentication for legacy clients.

Implement a secure token-based authentication scheme and require TLS for all clients.

A .NET application is being deployed to a Windows server. The application needs to read a connection string from a configuration file. The security team requires that the connection string be protected. Which approach should be used?

Use a custom configuration section that is not encrypted.

Store the connection string in plain text in web.config and restrict file permissions to only the application pool identity.

Hard-code the connection string in the application source code.

Encrypt the connection string section in web.config using aspnet_regiis.exe with the -pe option.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 8Objective 3

Secure Deployment at Host, Network, and Application Levels CASENET Practice Questions (Page 4)

Part of the Security Testing and Secure Deployment domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 16–20

16application · medium
A .NET web application is hosted on IIS and communicates with a backend API over the network. The security team requires that all communication be encrypted. Which protocol should be enforced?
Select an answer first
17application · medium
A .NET application is deployed to production. The security team wants to detect and respond to security incidents during and after deployment. Which monitoring and logging mechanism should be implemented?
Select an answer first
18expert · hard
A .NET application uses a custom authentication scheme. The security team requires that authentication be secure, but the application must also support legacy clients that cannot use modern protocols. What is the best approach?
Select an answer first
19application · medium
A .NET application is being deployed to a Windows server. The application needs to read a connection string from a configuration file. The security team requires that the connection string be protected. Which approach should be used?
Select an answer first
20foundation · easy
Which application-level configuration is essential to prevent detailed error messages from being exposed to end users in a production deployment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.