A .NET application has an admin panel that is accessible over the internet. The security team wants to reduce the risk of brute-force attacks on the admin login. The application uses ASP.NET Identity. Which combination of measures is most effective?

Enforce account lockout after a few failed attempts and require multi-factor authentication for admin accounts.

Add a CAPTCHA to the login form.

Restrict access to the admin panel by IP address allowlisting.

Use a longer password policy and require periodic password changes.

A team is threat-modeling an ASP.NET application that allows users to upload profile pictures. They draw a data flow diagram and identify an external entity (the user) sending data to a process (the upload handler) that stores files in a database. Which threat is most directly associated with the data flow between the user and the upload handler?

Tampering, because the uploaded file could contain malicious content.

Information disclosure, because the file could be accessed by unauthorized users.

Repudiation, because the user could deny uploading the file.

Spoofing, because the user could impersonate another user.

Which attack technique involves an attacker inserting malicious SQL statements into an application's input fields to manipulate database queries?

Cross-site request forgery (CSRF)

A security architect is using the STRIDE methodology to analyze a new ASP.NET Core application. They identify a threat where an attacker can modify the `role` claim in a JWT token to gain admin privileges. Which STRIDE category does this threat fall under, and what is the most effective mitigation?

Spoofing; use a stronger hashing algorithm for the token signature.

Tampering; validate the token signature and use HTTPS to protect the token in transit.

Denial of Service; limit the token size.

Information Disclosure; encrypt the token payload.

A team is using the STRIDE methodology to analyze a .NET application that allows users to transfer money between accounts. They identify a threat where an attacker can intercept the transfer request and change the destination account number. Which STRIDE category does this threat belong to, and what is the best mitigation?

Spoofing; use mutual TLS to authenticate both the client and server.

Denial of Service; rate-limit transfer requests.

Information Disclosure; encrypt the request payload.

Tampering; use TLS to protect the request in transit and a message authentication code (MAC) to detect changes.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 1Objective 1

Understanding Application Security, Threats, and Attacks CASENET Practice Questions (Page 7)

Part of the Application Security Foundations domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

4concepts

Questions 31–35

31expert · hard
A .NET application has an admin panel that is accessible over the internet. The security team wants to reduce the risk of brute-force attacks on the admin login. The application uses ASP.NET Identity. Which combination of measures is most effective?
Select an answer first
32application · medium
A team is threat-modeling an ASP.NET application that allows users to upload profile pictures. They draw a data flow diagram and identify an external entity (the user) sending data to a process (the upload handler) that stores files in a database. Which threat is most directly associated with the data flow between the user and the upload handler?
Select an answer first
33foundation · easy
Which attack technique involves an attacker inserting malicious SQL statements into an application's input fields to manipulate database queries?
Select an answer first
34application · medium
A security architect is using the STRIDE methodology to analyze a new ASP.NET Core application. They identify a threat where an attacker can modify the `role` claim in a JWT token to gain admin privileges. Which STRIDE category does this threat fall under, and what is the most effective mitigation?
Select an answer first
35application · medium
A team is using the STRIDE methodology to analyze a .NET application that allows users to transfer money between accounts. They identify a threat where an attacker can intercept the transfer request and change the destination account number. Which STRIDE category does this threat belong to, and what is the best mitigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Understanding Application Security, Threats, and Attacks CASENET Practice Questions (Page 7)

Questions 31–35

A .NET application has an admin panel that is accessible over the internet. The security team wants to reduce the risk of brute-force attacks on the admin login. The application uses ASP.NET Identity. Which combination of measures is most effective?

Which attack technique involves an attacker inserting malicious SQL statements into an application's input fields to manipulate database queries?

A security architect is using the STRIDE methodology to analyze a new ASP.NET Core application. They identify a threat where an attacker can modify the `role` claim in a JWT token to gain admin privileges. Which STRIDE category does this threat fall under, and what is the most effective mitigation?

Keep studying — Application Security Foundations