A .NET application is deployed to a web server that also hosts other applications. The security team wants to ensure that the application is isolated from other applications on the same server. Which control should be implemented?

Use a virtual directory to host the application under the default website.

Create a separate application pool for the application and configure the pool to run under a unique low-privilege account.

Set the application pool's .NET CLR version to v4.0.

Enable IIS request filtering to block malicious requests.

A .NET web application is being deployed to production. The application uses forms authentication and has custom error pages. The security team requires that detailed error messages are not shown to end users. Which configuration should be applied in the web.config file?

Set compilation debug="true" to enable detailed error logging.

Set httpErrors errorMode="Detailed" in IIS configuration.

Set customErrors mode="Off" and rely on the application's global exception handler.

Set customErrors mode="On" and provide a defaultRedirect to a generic error page.

A .NET application is being deployed to a production server. The application requires access to a database and a third-party API. The security team requires that the application use least privilege and that secrets be protected. Which approach best meets these requirements?

Use a shared service account with broad permissions and store the credentials in a text file.

Use a dedicated service account with only the necessary permissions and store the credentials in a secret management service.

Use the application pool identity with default permissions and store the credentials in the registry.

Use the LocalSystem account for the application pool and store the credentials in the web.config file.

A .NET application uses a SQL Server database on a separate server. The security team wants to ensure that the database is protected against common threats. Which configuration should be implemented?

Disable the sa account and use Windows authentication with least-privilege service accounts.

Allow all inbound traffic to the database port from any source.

Enable SQL Server authentication and use a strong password for the sa account.

Place the database server on the same subnet as the web server for faster access.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 8Objective 3

Secure Deployment at Host, Network, and Application Levels CASENET Practice Questions (Page 8)

Part of the Security Testing and Secure Deployment domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 36–40

36application · medium
A .NET application is deployed to a web server that also hosts other applications. The security team wants to ensure that the application is isolated from other applications on the same server. Which control should be implemented?
Select an answer first
37foundation · easy
Which phase of the secure deployment lifecycle involves verifying that the deployed application is functioning correctly and securely in the production environment?
Select an answer first
38application · medium
A .NET web application is being deployed to production. The application uses forms authentication and has custom error pages. The security team requires that detailed error messages are not shown to end users. Which configuration should be applied in the web.config file?
Select an answer first
39expert · medium
A .NET application is being deployed to a production server. The application requires access to a database and a third-party API. The security team requires that the application use least privilege and that secrets be protected. Which approach best meets these requirements?
Select an answer first
40application · medium
A .NET application uses a SQL Server database on a separate server. The security team wants to ensure that the database is protected against common threats. Which configuration should be implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.