ViewState-based Session Management CASENET Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security audit of an ASP.NET application finds that ViewState is enabled on all pages, including login and public pages. The application uses ViewState for a few controls on authenticated pages. The auditor recommends disabling ViewState on public pages. The developer is concerned that disabling ViewState on a public page might break a control that uses it. What is the best way to handle this?

   • AKeep ViewState enabled on all pages but set EnableViewStateMac to true.
   • BDisable ViewState at the page level for public pages and enable it only for the specific controls that need it.
   • CDisable ViewState on all pages and use Session for all state.
   • DSet ViewStateEncryptionMode to Always on public pages.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How can ViewState be used in conjunction with session state in an ASP.NET application?

   • AViewState can be used to synchronize session data across multiple servers in a web farm.
   • BViewState can replace session state entirely, storing all user-specific data on the client.
   • CViewState can be used to store the entire session object in a hidden field for faster access.
   • DViewState can store a session identifier that is used to retrieve user-specific data from server-side session state.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common security risk associated with ViewState in ASP.NET?

   • AViewState is stored on the server, making it vulnerable to server-side injection attacks.
   • BViewState is encrypted by default, but the encryption key is hardcoded in the page source.
   • CViewState can be tampered with by an attacker if MAC validation is not enabled.
   • DViewState automatically exposes the session ID to other users through the hidden field.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An ASP.NET application is deployed on a web farm with two servers. The developer configured a machineKey in web.config, but users intermittently receive 'Validation of viewstate MAC failed' errors. The developer suspects the machineKey is not being used. What is the most likely cause?

   • AThe machineKey is set in the machine.config on one server but not on the other.
   • BThe ViewState is being encrypted with a different algorithm on each server.
   • CThe machineKey is specified in the web.config of each server, but the servers are using different application names, causing different auto-generated keys.
   • DThe servers are using different .NET Framework versions.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An ASP.NET page has a control that needs to maintain its state across postbacks. The developer notices that the ViewState is large and contains data that is not needed after the postback. The developer wants to reduce the ViewState size without affecting the control's functionality. What is the best approach?

   • ASet EnableViewState to false for the control and rely on the page's ViewState.
   • BUse the ControlState property for the essential data and disable ViewState for the control.
   • CStore the data in Session and use ViewState for the control's state.
   • DCompress the ViewState using a custom HttpModule.
   Reveal Solution Discussion Select an answer first