Understanding Application Security, Threats, and Attacks CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A development team is using STRIDE to threat-model a new ASP.NET Core web API that accepts file uploads from authenticated users. They identify a threat where an attacker uploads a file with a double extension (e.g., `malicious.aspx.exe`) and the server executes it. Which STRIDE category does this threat belong to, and what is the most effective mitigation?

   • ASpoofing; validate the file's MIME type against an allowlist.
   • BDenial of Service; limit the maximum file size and number of uploads per user.
   • CTampering; store uploaded files in a separate directory with script execution disabled.
   • DElevation of Privilege; enforce role-based access control on the upload endpoint.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A .NET developer is implementing a file download feature. The file name is provided by the user and used directly in the `Content-Disposition` header. A tester submits a file name containing ` ` and injects an extra header. Which security principle was violated, and what is the best fix?

   • ALeast privilege; run the download handler with minimal permissions.
   • BInput validation; reject any file name that contains carriage return or line feed characters.
   • CDefense in depth; add a second header with the file name.
   • DOutput encoding; URL-encode the file name in the header.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A .NET developer is implementing password storage for a new application. The application will be used by employees and must comply with internal security policies that require strong password storage. Which approach is the most secure and recommended?

   • AEncrypt passwords with AES and store the key in the web.config
   • BStore passwords in plain text in a database with restricted access
   • CHash passwords with MD5 and a global salt
   • DUse a strong one-way hashing algorithm with a unique salt per user, such as PBKDF2 or bcrypt
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A .NET application allows users to submit comments that are displayed to other users. A tester submits `<img src=x onerror=alert(1)>` and the script executes in other users' browsers. The team wants to fix this vulnerability. Which remediation is most appropriate?

   • AEncode the comment text with `HttpUtility.HtmlEncode` before rendering.
   • BStore the comments in a database with parameterized queries.
   • CUse a regular expression to remove all `<script>` tags from the input.
   • DSet the `X-XSS-Protection` header to `1; mode=block`.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A .NET application allows users to upload profile pictures. The application stores the files on disk and serves them via a static file handler. A security review finds that the application does not validate the file content type. Which combination of controls best mitigates the risk of malicious file upload?

   • AUse a blacklist of dangerous file extensions
   • BStore files in the database as BLOBs and render them inline
   • CValidate the file signature (magic bytes) and serve uploads from a separate domain with Content-Disposition: attachment
   • DRely on the client-side file input accept attribute
   Reveal Solution Discussion Select an answer first