A .NET web application is vulnerable to SQL injection because user input is concatenated directly into SQL queries. Which mitigation strategy is most appropriate to address this threat?

Adding a CAPTCHA to the login form

Encrypting the database connection string

Using parameterized queries or stored procedures

During a threat modeling exercise for a .NET REST API that handles financial transactions, the team draws a data flow diagram. They identify that the API accepts a 'transactionId' parameter from the client and uses it directly in a SQL query to retrieve transaction details. The API also logs the full request body, including the transaction amount, to a text file. Which STRIDE categories are most directly applicable to these two findings?

Tampering and Denial of Service

Repudiation and Denial of Service

Spoofing and Elevation of Privilege

Tampering and Information Disclosure

A .NET application is being migrated from a monolithic architecture to microservices. The current application has a single public endpoint that handles all requests. The new architecture will expose several microservices, each with its own endpoint. The team wants to minimize the attack surface while maintaining functionality. Which approach best achieves this?

Expose only the necessary microservices to the internet and keep internal microservices on a private network, using an API gateway as the single entry point.

Use a single microservice that combines all functionality to reduce the number of endpoints.

Expose all microservices directly to the internet to simplify client access.

Place all microservices behind a load balancer but allow direct access to each service for debugging.

During a threat modeling workshop, the team identifies a threat that could allow an attacker to delete audit logs, covering their tracks. Which STRIDE category does this threat belong to, and what is the most appropriate mitigation?

Repudiation; mitigate by using write-once storage or append-only logs with strict access controls.

Denial of Service; mitigate by increasing log storage capacity.

Tampering; mitigate by encrypting the logs.

Information Disclosure; mitigate by redacting sensitive data in logs.

Why is it important to identify and prioritize assets during the threat modeling process?

To focus mitigation efforts on the assets that are most critical to the organization

To satisfy regulatory compliance only

To ensure all assets are equally protected regardless of value

To eliminate the need for security testing

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 6

Secure Design Principles CASENET Practice Questions (Page 5)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 21–25

21foundation · easy
A .NET web application is vulnerable to SQL injection because user input is concatenated directly into SQL queries. Which mitigation strategy is most appropriate to address this threat?
Select an answer first
22application · medium
During a threat modeling exercise for a .NET REST API that handles financial transactions, the team draws a data flow diagram. They identify that the API accepts a 'transactionId' parameter from the client and uses it directly in a SQL query to retrieve transaction details. The API also logs the full request body, including the transaction amount, to a text file. Which STRIDE categories are most directly applicable to these two findings?
Select an answer first
23expert · hard
A .NET application is being migrated from a monolithic architecture to microservices. The current application has a single public endpoint that handles all requests. The new architecture will expose several microservices, each with its own endpoint. The team wants to minimize the attack surface while maintaining functionality. Which approach best achieves this?
Select an answer first
24application · medium
During a threat modeling workshop, the team identifies a threat that could allow an attacker to delete audit logs, covering their tracks. Which STRIDE category does this threat belong to, and what is the most appropriate mitigation?
Select an answer first
25foundation · easy
Why is it important to identify and prioritize assets during the threat modeling process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Secure Design Principles CASENET Practice Questions (Page 5)

Questions 21–25

A .NET web application is vulnerable to SQL injection because user input is concatenated directly into SQL queries. Which mitigation strategy is most appropriate to address this threat?

During a threat modeling workshop, the team identifies a threat that could allow an attacker to delete audit logs, covering their tracks. Which STRIDE category does this threat belong to, and what is the most appropriate mitigation?

Why is it important to identify and prioritize assets during the threat modeling process?

Keep studying — Security Requirements and Secure Design