A .NET application is deployed in a three-tier architecture: web servers, application servers, and a SQL Server database. The security team wants to ensure that the database is not accessible from the public internet. Which network-level control should be implemented?

Install a web application firewall (WAF) in front of the database server.

Configure the database server to use a strong SA password and enable SQL Server authentication.

Enable Transparent Data Encryption (TDE) on the database.

Place the database in a separate subnet with a network security group that only allows traffic from the application subnet on port 1433.

A .NET application is deployed and the security team wants to set up monitoring to detect a data breach. The team has limited resources and must choose between logging all application events or logging only security-related events. What is the best approach?

Log only security-related events to reduce storage costs.

Log all application events and use automated tools to filter and alert on security-related events.

Log only errors and exceptions.

Log all events but do not review them regularly.

A DevOps team is deploying a .NET application to a production server. The deployment process includes a rollback plan. When should the rollback plan be executed?

If the application's performance is slightly slower than expected.

If the pre-deployment checks find that the server is missing a required security patch.

If the post-deployment verification detects a critical security vulnerability or application failure.

If the deployment takes longer than the estimated time.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 8Objective 3

Secure Deployment at Host, Network, and Application Levels CASENET Practice Questions (Page 6)

Part of the Security Testing and Secure Deployment domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 26–30

26application · medium
A .NET application is deployed in a three-tier architecture: web servers, application servers, and a SQL Server database. The security team wants to ensure that the database is not accessible from the public internet. Which network-level control should be implemented?
Select an answer first
27expert · hard
A .NET application is deployed and the security team wants to set up monitoring to detect a data breach. The team has limited resources and must choose between logging all application events or logging only security-related events. What is the best approach?
Select an answer first
28foundation · easy
Which application-level setting is used to control what authenticated users are allowed to do within a deployed .NET application?
Select an answer first
29application · medium
A DevOps team is deploying a .NET application to a production server. The deployment process includes a rollback plan. When should the rollback plan be executed?
Select an answer first
30foundation · easy
Which protocol is commonly used to provide encrypted communication between a client and a deployed .NET web application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Secure Deployment at Host, Network, and Application Levels CASENET Practice Questions (Page 6)

Questions 26–30

A .NET application is deployed in a three-tier architecture: web servers, application servers, and a SQL Server database. The security team wants to ensure that the database is not accessible from the public internet. Which network-level control should be implemented?

A .NET application is deployed and the security team wants to set up monitoring to detect a data breach. The team has limited resources and must choose between logging all application events or logging only security-related events. What is the best approach?

Which application-level setting is used to control what authenticated users are allowed to do within a deployed .NET application?

A DevOps team is deploying a .NET application to a production server. The deployment process includes a rollback plan. When should the rollback plan be executed?

Which protocol is commonly used to provide encrypted communication between a client and a deployed .NET web application?

Keep studying — Security Testing and Secure Deployment