ViewState-based Session Management CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An ASP.NET application is being hardened. The security team wants to ensure that ViewState cannot be tampered with and that its contents are not readable by the client. The application does not use ViewState for any sensitive data, but the team wants defense-in-depth. What configuration should be applied?

   • ASet the EnableViewStateMac attribute to false to improve performance.
   • BDisable ViewState entirely on all pages.
   • CSet ViewStateEncryptionMode to Never and rely on MAC validation only.
   • DSet ViewStateEncryptionMode to Always and ensure MAC validation is enabled.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A developer is reviewing an ASP.NET page that uses ViewState to store a user's account number for display after postback. The application does not require ViewState for any other purpose. The security policy states that sensitive data should not be exposed to the client. What is the best practice?

   • ARemove the account number from ViewState and retrieve it from the database using the authenticated user's session.
   • BEncrypt the ViewState so the account number is not readable.
   • CStore the account number in a hidden field instead of ViewState.
   • DMask the account number in ViewState and unmask it on the server.
   Reveal Solution Discussion Select an answer first
4. 23application · easy

   A security scan flags that an ASP.NET application's ViewState is not protected against tampering. The application is deployed on a single server and uses the default machineKey configuration. Which action should the developer take to mitigate the risk?

   • ASet <pages viewStateEncryptionMode="Always" /> in web.config.
   • BSet <pages enableViewStateMac="true" /> in web.config.
   • CSet <machineKey validation="SHA1" /> in web.config.
   • DSet <httpCookies requireSSL="true" /> in web.config.
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   An ASP.NET application is deployed on a single server. The developer wants to ensure that ViewState is protected against both tampering and disclosure. The application currently has ViewState MAC validation enabled but encryption is disabled. What is the minimum change required?

   • ADisable ViewState and use Session.
   • BSet a fixed machineKey.
   • CEnable ViewState MAC validation.
   • DEnable ViewState encryption by setting viewStateEncryptionMode="Always".
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security audit reveals that an ASP.NET application's ViewState is not protected against tampering. The application runs on a single server and uses ViewState for a non-sensitive UI state. The developer needs to implement a quick fix to ensure ViewState integrity. What should the developer do?

   • AStore ViewState in a database instead of in the page.
   • BDisable ViewState on all pages to eliminate the risk.
   • CEnable MAC validation by setting EnableViewStateMac to true in the page directive or web.config.
   • DSet ViewStateEncryptionMode to Always to protect the data.
   Reveal Solution Discussion Select an answer first