ViewState-based Session Management CASENET Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An ASP.NET application must comply with a policy that prohibits storing personally identifiable information (PII) in client-side state. Currently, a page stores a user's email address in ViewState. What is the best course of action?

   • AMove the email address to Session and disable ViewState for the page.
   • BStore the email address in a hidden field instead.
   • CUse ViewState MAC validation to ensure the email is not tampered with.
   • DEncrypt the ViewState to protect the email address.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer notices that a page's ViewState contains a serialized object with a property that was not present in the original page class. After a postback, the application throws a deserialization error. What is the most likely cause and the best fix?

   • AThe ViewState is encrypted with a different key; reconfigure the machineKey.
   • BThe ViewState was tampered with by the client; enable ViewState MAC validation.
   • CThe ViewState is too large; enable ViewState compression.
   • DThe page class was modified after the ViewState was generated; ensure the page class is backward-compatible or use a version-tolerant serializer.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security audit reveals that an ASP.NET application stores a user's role and account ID in ViewState. The application currently has ViewState encryption disabled. The compliance team requires that this data be protected from both tampering and disclosure. What should the developer configure?

   • ASet <pages viewStateEncryptionMode="Always" /> and ensure the machineKey is configured with a decryption key.
   • BSet <pages viewStateEncryptionMode="Never" /> and rely on SSL/TLS to protect data in transit.
   • CMove the role and account ID to a server-side Session object and disable ViewState for the page.
   • DSet <pages enableViewStateMac="true" /> only.
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   An ASP.NET page displays a user's date of birth and a non-sensitive preference flag. The page does not need to maintain any state across postbacks. According to best practices, what should the developer do?

   • ADisable ViewState for the page by setting EnableViewState="false" on the Page directive.
   • BEnable ViewState encryption to protect the date of birth.
   • CUse Session to store the date of birth and preference flag.
   • DStore the date of birth in ViewState and the preference flag in a hidden field.
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   An application uses ViewState to store a user's selected language preference. The preference is also stored in a cookie. The developer wants to reduce the ViewState size and avoid duplicating data. What is the best approach?

   • ARemove the language preference from ViewState and rely solely on the cookie.
   • BEncrypt the ViewState to protect the preference.
   • CStore the preference in both ViewState and cookie to ensure redundancy.
   • DKeep the preference in ViewState and remove the cookie.
   Reveal Solution Discussion Select an answer first