ViewState-based Session Management CASENET Practice Questions (Page 8)

Questions 36–38

1. 36application · medium

   A developer is reviewing an ASP.NET page that uses ViewState to store a non-sensitive UI state (e.g., which tab is active). The page is public and does not require authentication. Which practice is most appropriate?

   • AStore the active tab in a query string parameter.
   • BKeep ViewState enabled and rely on the default MAC validation.
   • CEnable ViewState encryption to protect the active tab.
   • DDisable ViewState and use Session to store the active tab.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which configuration setting enables ViewState MAC validation in ASP.NET to protect against tampering?

   • ASet the `compilation` debug attribute to `false` in web.config.
   • BSet the `sessionState` mode to `InProc` in web.config.
   • CSet the `enableViewStateMac` attribute to `true` in the `pages` element of web.config.
   • DSet the `httpCookies` httpOnlyCookies attribute to `true` in web.config.
   Reveal Solution Discussion Select an answer first
3. 38application · medium

   A company's ASP.NET Web Forms application is deployed on a web farm. The security team requires that ViewState be protected against tampering and that the validation key be consistent across all servers. The developer is configuring the machineKey element in web.config. What should the developer do?

   • AUse a different validationKey on each server but the same decryptionKey.
   • BDisable ViewState MAC validation to avoid key management overhead.
   • CLet each server auto-generate its own machineKey.
   • DSet the same explicit machineKey with validationKey and decryptionKey on all servers.
   Reveal Solution Discussion Select an answer first