Understanding Application Security, Threats, and Attacks CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A development team is using STRIDE to threat-model a new ASP.NET Core web API that exposes customer data. The API uses token-based authentication and stores sensitive data in an Azure SQL database. During the modeling session, the team identifies a threat where an attacker who obtains a valid token can access another user's data by changing an ID in the URL. Which STRIDE category does this threat belong to, and which control is most directly relevant?

   • ADenial of Service; implement rate limiting
   • BInformation Disclosure; enforce object-level authorization checks
   • CTampering; add request signing
   • DSpoofing; require stronger token signing
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In the STRIDE threat model, what does the 'R' stand for?

   • ARepudiation
   • BReplay
   • CResource exhaustion
   • DRemote code execution
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A development team is adopting a DevSecOps approach for a .NET application. The team wants to integrate security testing into the CI/CD pipeline. The application is updated frequently, and the team needs to balance speed and security. Which combination of practices is most effective?

   • ARun DAST on every commit and SAST only before release
   • BRun static application security testing (SAST) on every commit, dynamic application security testing (DAST) on staging builds, and dependency scanning on the final build
   • CUse SAST only on the final release candidate
   • DPerform only manual penetration testing before each release
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large enterprise is developing a new customer-facing .NET web application. The security team has mandated that threat modeling be integrated into the SDLC. The development team is concerned that threat modeling will slow down the release cycle. The project manager wants to balance security with delivery speed. Which approach best addresses both concerns?

   • AConduct a single comprehensive threat modeling exercise after the application is fully developed
   • BPerform a lightweight threat modeling session at the design phase and update it during each sprint for new features
   • CSkip threat modeling and rely on penetration testing before release
   • DUse a third-party tool to automatically generate a threat model without developer involvement
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A .NET web application is deployed behind a load balancer that terminates TLS. The application uses Forms Authentication and sets a cookie named `AuthCookie`. A security review finds that the cookie is not marked `Secure`. The load balancer forwards HTTP requests to the application server. Which of the following is the most effective way to ensure the cookie is only sent over HTTPS?

   • ASet the `Secure` attribute on the cookie in the application code, and configure the load balancer to forward the `X-Forwarded-Proto` header.
   • BSet the `HttpOnly` attribute on the cookie to prevent JavaScript access.
   • CEncrypt the cookie value using `MachineKey` protection.
   • DUse URL rewriting to redirect all HTTP requests to HTTPS at the load balancer.
   Reveal Solution Discussion Select an answer first