Understanding Application Security, Threats, and Attacks CASENET Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A financial services company is developing a .NET application that processes loan applications. The application accepts document uploads (PDF, DOCX) and stores them in a database. The security team performs a threat model and identifies the following risks: (1) an attacker uploads a malicious file that is later downloaded and executed on an admin's machine, (2) an attacker uploads a file with a path traversal name like `..\..\config.aspx`, (3) an attacker uploads a file that is larger than the allowed limit, causing disk exhaustion. The team must prioritize mitigations. Which combination of mitigations addresses the most critical risks with the least implementation effort?

   • AImplement a virus scanner on the upload endpoint and reject any file that contains a known signature.
   • BEncrypt all uploaded files with AES-256 before storing them in the database.
   • CUse a content security policy (CSP) to restrict script execution on the download page.
   • DStore files in a separate directory outside the web root, validate file extensions against an allowlist, and enforce a maximum file size.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A .NET application has a search feature that displays user input in the page. The development team has implemented output encoding, but a penetration test still finds a DOM-based XSS vulnerability. The vulnerability exists because the application reads a value from the URL fragment and writes it to the DOM using innerHTML. Which action is the most effective fix?

   • AValidate the input to allow only alphanumeric characters
   • BAdd a Content Security Policy (CSP) that blocks inline scripts
   • CEncode the value on the server before sending it to the client
   • DUse textContent instead of innerHTML when writing the value to the DOM
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team is investigating a breach in a .NET application. The logs show that an attacker submitted a large number of login requests with different passwords for the same username. The application uses ASP.NET Identity with default lockout settings. The attacker was able to successfully log in after several attempts. Which security control is most likely missing, and what is the best remediation?

   • AIncrease the lockout threshold to allow more attempts before locking
   • BDisable account lockout to avoid denial-of-service
   • CAccount lockout is not effective against distributed brute-force attacks; implement multi-factor authentication (MFA) and rate limiting
   • DUse a longer password policy
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In the context of the software development lifecycle (SDLC), what is the primary purpose of application security?

   • ATo perform a single security review at the end of the SDLC before release
   • BTo integrate security practices and controls throughout the SDLC to protect applications from threats and reduce risk
   • CTo ensure that applications are free from all possible vulnerabilities before deployment
   • DTo focus exclusively on network-level defenses and perimeter security for applications
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A .NET application stores user passwords in a database. The security team requires that passwords be stored in a way that resists brute-force attacks even if the database is compromised. Which approach should the team use?

   • AHash passwords with SHA-256 and a unique salt per user.
   • BUse a keyed hash (HMAC) with a global secret key.
   • CEncrypt passwords with AES-256 using a hardcoded key in the application.
   • DUse a slow, salted hashing algorithm such as PBKDF2, bcrypt, or Argon2.
   Reveal Solution Discussion Select an answer first