ViewState-based Session Management CASENET Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which practice is considered a secure ViewState usage guideline?

   • AEnable ViewState for all controls on a page to ensure maximum functionality.
   • BAvoid storing sensitive data such as personally identifiable information (PII) in ViewState.
   • CUse ViewState to store application-wide configuration settings for faster access.
   • DStore the user's session ID in ViewState to improve performance.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A financial application uses ViewState to store a user's account balance for display after postback. The ViewState is encrypted and MAC-validated. A security review recommends not storing the balance in ViewState. The developer argues that encryption and MAC make it safe. The security team insists on removing it. What is the primary reason the security team is correct?

   • AEncrypted ViewState can still be decrypted by the server, but the data is exposed to the client in the page source, violating the principle of least privilege.
   • BThe ViewState could be replayed from a previous session.
   • CThe ViewState encryption key could be brute-forced by an attacker.
   • DMAC validation does not prevent the server from reading the data, but it does not protect against information disclosure.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An ASP.NET application is being migrated from a single server to a load-balanced web farm. The application uses ViewState with encryption and MAC validation. The developer must ensure that ViewState works across all servers. What is the most important configuration step?

   • ADisable ViewState on all servers to avoid cross-server issues.
   • BUse a sticky session load balancer to ensure requests go to the same server.
   • CSet ViewStateEncryptionMode to Always on all servers.
   • DSet the same machineKey on all servers in the farm.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A penetration test reveals that an attacker can modify the ViewState of an ASP.NET page to change a product price displayed on the page. The application currently has ViewState encryption enabled but MAC validation is disabled. What is the most effective mitigation?

   • AUse SSL/TLS to protect the ViewState in transit.
   • BStore the price in a hidden field instead of ViewState.
   • CDisable ViewState encryption.
   • DEnable ViewState MAC validation.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A developer is troubleshooting an ASP.NET Web Forms application that intermittently throws 'Validation of viewstate MAC failed' errors after a recent deployment. The application uses a web farm behind a load balancer, and the machineKey was not explicitly configured. Which configuration change should be made to resolve the issue without disabling security?

   • ASet <machineKey validationKey="[fixed 64-byte key]" decryptionKey="[fixed 32-byte key]" validation="SHA256" /> identically on all servers in the web farm.
   • BSet <machineKey validationKey="AutoGenerate" decryptionKey="AutoGenerate" validation="SHA1" /> in each server's web.config.
   • CSet <pages enableViewStateMac="false" /> in the web.config to bypass MAC validation.
   • DSet <machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps" validation="SHA1" /> in each server's web.config.
   Reveal Solution Discussion Select an answer first