ViewState-based Session Management CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An ASP.NET application stores a user's role name in ViewState to customize UI elements after postback. A penetration test reveals that an attacker can modify the role value and escalate privileges. The developer must fix this vulnerability while keeping the role data available on the server after postback. What is the most appropriate action?

   • AUse a hidden field instead of ViewState to store the role.
   • BEncode the role value with HTML encoding before storing it in ViewState.
   • CRemove the role from ViewState and retrieve it from the server-side session on each postback.
   • DEnable ViewState MAC validation and encryption for the role field.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a recommended best practice for using ViewState securely in an ASP.NET application?

   • AAlways enable ViewState for every page to ensure state is preserved across postbacks.
   • BDisable ViewState for pages that do not require it to reduce attack surface and page size.
   • CUse ViewState to store sensitive data such as passwords and credit card numbers for convenience.
   • DStore all user-specific data in ViewState to avoid server-side session management.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An ASP.NET application has a page that does not use ViewState for any functionality. The developer wants to improve security and performance. What is the recommended action?

   • ALeave ViewState enabled but set EnableViewStateMac to true.
   • BMove the page to use Session state instead of ViewState.
   • CSet ViewStateEncryptionMode to Always to protect the empty ViewState.
   • DSet EnableViewState to false for the page.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the purpose of enabling ViewState encryption in an ASP.NET application?

   • ATo prevent the ViewState from being read by the client, ensuring confidentiality of its contents.
   • BTo reduce the size of the ViewState so it loads faster in the browser.
   • CTo allow the ViewState to be stored in a server-side database for better performance.
   • DTo enable the ViewState to be shared across multiple servers in a web farm.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A multi-tenant ASP.NET application uses ViewState to store the tenant ID so that the correct theme is applied after postback. The tenant ID is not sensitive, but a security review flags that an attacker could change the tenant ID in ViewState to access another tenant's theme. The developer must prevent this without moving the tenant ID to Session. What is the best solution?

   • AEnable ViewState MAC validation to ensure the tenant ID cannot be tampered with.
   • BStore the tenant ID in a hidden field and validate it on the server.
   • CUse a custom ViewState provider that stores the tenant ID in a database.
   • DEncrypt the ViewState to hide the tenant ID from the client.
   Reveal Solution Discussion Select an answer first