Understanding Application Security, Threats, and Attacks CASENET Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst is reviewing an ASP.NET application that uses a third-party component to generate PDF reports. The component has a known vulnerability that allows remote code execution. The vendor has not yet released a patch. Which action is the most appropriate immediate mitigation?

   • AApply a virtual patch or workaround, such as disabling the vulnerable feature or adding an input validation rule
   • BIgnore the vulnerability because the component is only used internally
   • CRemove the component from the application immediately
   • DUpgrade to the latest version of the component even if it is not patched
   Reveal Solution Discussion Select an answer first
2. 37expert · hard · select all that apply

   A security team is performing a threat model for a .NET application that allows users to upload profile pictures. The application stores the files in a directory under the web root and serves them directly. The team identifies the following threats: (1) an attacker uploads a file with a `.aspx` extension and the server executes it, (2) an attacker uploads a file with a path traversal name to overwrite a configuration file, (3) an attacker uploads a file that is too large, causing disk exhaustion. Which of the following mitigations directly address these threats? Select all that apply.

   • AValidate the file name against a whitelist of allowed characters and reject any path separators.
   • BStore uploaded files outside the web root and serve them via a handler that sets the correct Content-Type.
   • CSet the `HttpOnly` flag on the session cookie.
   • DUse a Content Security Policy (CSP) to restrict script sources.
   • EEnforce a maximum file size limit at the application level.
   Check answers Discussion Select an answer first
4. 38expert · hard

   A security architect is threat-modeling a .NET application that will be accessible over the internet. The application uses a three-tier architecture: web, application, and database. The architect is considering where to place a web application firewall (WAF). Which placement provides the most comprehensive protection?

   • ABetween the application tier and the database tier
   • BOn each application server individually
   • CIn front of the web tier, filtering all incoming traffic before it reaches the application
   • DOnly in front of the database tier
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A .NET application uses a third-party REST API to fetch data. The API requires an API key. The developer hardcodes the API key in the source code. A security review flags this as a risk. Which remediation is the most secure and practical?

   • AUse a less privileged API key that only has read access
   • BEncrypt the API key in the web.config and decrypt it at runtime
   • CStore the API key in a secure secret management service and retrieve it at runtime
   • DObfuscate the API key in the source code
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A .NET application is being redesigned to improve security. The current application stores session tokens in cookies without the Secure or HttpOnly flags. The new design must protect against session hijacking and XSS. The team is considering two options: Option 1 sets the Secure and HttpOnly flags on the session cookie. Option 2 uses a JavaScript-based token storage mechanism. Which option is more secure, and why?

   • AOption 1, because cookies are inherently secure
   • BOption 1, because HttpOnly prevents JavaScript access and Secure ensures transmission only over HTTPS
   • COption 2, because JavaScript-based storage is more secure than cookies
   • DOption 2, because it prevents CSRF attacks
   Reveal Solution Discussion Select an answer first