Font size
WorksheetsCASE Net Unit 4-6
Total questions: 50
Worksheet time: 50mins
What techniques are used to eliminate the vulnerabilities in web application?
A proper input validation
Injection attacks
Vulnerable attacks
Which are the TWO approaches that the developer can take to perform input validation?
Client-side Input Validation
SQL Input validation
Server-side Input Validation
A client-side language is used to perform client side validation that includes languages such as...
PHP
JavaScript
VBScript
Server-side Input Validation consumes extra time and ______________
Data
Processes
Bandwidth
Network traffic
What is an Input Filtering?
A process of rejecting or accepting user inputs as per predefined criteria
It prevents the application from unrecognized or malicious inputs
The user input matches or compares with the predefined set of input characters to determine acceptability
All of the above
There are two techniques to filter inputs.
Select the correct answers
Black Listing
User Inputs
Malicious Inputs
White Listing
What is the usage of a RequiredField validation control
Is to ensure that designated input fields are not left blank
To add control in the web
To custom summary control
The server tag <asp:RangeValidator> is used to...
Ensure that designated input fields are not left blank
Add the RequireField validation control in the web form for a specific input field
Add the range validation control in the web for specific input field
What tag is actually used to add the RegularExpression Validation control?
<asp: RegularExpressionValidator>
<asp: RegularExpressionController>
<asp: RegularExpressionValidatorInput>
asp: RegularExpressionValidator
The server tag <asp: ValidationSummary> is used to ...
Add Validation Summary Control
To summary the web
To display any error message summary
All of the above
This techniques helps in distinguishing between ________ and _________________________ of user input.
Code, data irrespective
Parameters, query
SQL, data irrespective
The parameterized stored procedure also allows the developer
To write SQL code
To escape special characters from user input before supplying them to query
To replace the escape characters
A type of users inputs can be HTML, JavaScript, uploaded files, White List
True
False
If the HtmlEncode method is not used, then malicious input may...
Return to an error that request it out of bounds
Harm the application
Be added using middleware
What is an output encoding?
A technique in which characters are treated as data instead of characters themselves
Is the amount of codes produced by a machine
Is the process of converting data from one form to another.
Choose which word describes better the process of rejecting users inputs as per predefined criteria.
Server-slide
Input Validation
Input Filtering
Output Validation
Difference between Authentication and Authorization
Choose only the ones that describes Authentication
Is the process of verifying a user's identity
Is always performed first than the other process
Is a process of giving a specific rights to other process
Choose the meaning of Account Hijacking
Intercepting the traffic to read and modify data
Accessing the account of a legitimate user by guessing or stealing the credentials
Acquiring higher level privileges for an account
What is Phishing
Luring the legitimate user to enter his/her credential through fake website links
Intercepting the traffic to read or modify data during transmission
Gaining access to restricted resources
Select which common attack means "Acquiring Higher-level privileges for an account"
Phising
Privilege Escalation
Sniffing privileges
Unauthorized access
Which one uses client certificates to prove their identity?
Certificate Authentication
Anonymous authentication
Choose the statements that describes "Impersonation"
A process of ensuring user identity to access protected resources.
Is the approval or denial of the access to resources is based on user identity
It helps run server processes by using security credentials of the client
Choose true or false if an Impersonation Option is missing.
-Impersonation is Disabled
-Impersonation Enabled
-Impersonation Enabled for a Specific Identity
FALSE
TRUE
Select the ways of programming for user authorization
Explicit Authorization
Declarative Authorization
Imperative Authorization
User Authorization
SQL Server supports Three types of roles
User-defined Database Roles
Application Roles
SQL Role
Fixed Database Roles
IdentityServer4 is an _______________ and ____________ framework for ASP.NET Core 2
OpenID Connect, OAuth 2.0
Issues access token, APIs
Implement ASP.NET, Mvc Client
Which is the name of Namespace for Authorization?
Microsoft.AspNetCore.Authorization
ASP.NetCoreIdentity
AuthorizationHandlers
ASP.Net Core Identity (ASP.NetCoreIdentity) provides _______________ to manage roles
RoleManager
Control Management
RoleAdministrator
What should be used to prevent users from repeated login attempts with wrong passwords
The number of failed login attempts should be set to the minimum level
The number of failed login attempts should be set to the maximum level
Regular expressions are used to validate the _______________ entered through the ____________________ control
Expressions, validation
Expressions, CreateUserWizard
Password, CreateUserWizard
________________ is the process of verifying a user's identity with an application on the basis of verification of some sort of credentials
Identification
Authentication
Delegation
None of the above
Name the process of giving an authenticated user the specific rights to access a particular resource
(a)
Delegation is a more powerful form of impersonation where ____________ can access the resources located on remote server
ASP.NET
SQL
System.Web.MVC
Each of these processes is performed at different levels of the .NET web application security architectures
Choose the right ones
ASP.NET
Enterprise Services
SQL server level
All of the above
____________________ refers to protection of information by transforming it in such a way that resulting transformed form is unreadable to an unauthorized party
Signatures
Cryptography
Code
Hashing
Ciphers are _____________ used to encrypt or decrypt the data.
Encrypted data
Encryption Keys
Algorithms
Functions of Cryptography
Confidentially
Integrity
Non-repudiation
Authentication
All of the above
What should you do to secure .NET Applications from Cryptographic attacks?
Avoid implementing custom cryptography function as it may create weak encryption
Keep the keys as long as possible
Change keys periodically
Use digital signatures for improving asymmetric encryption
Secure XML document using digital signature
.NET Cryptography Namespaces
System.Security.Cryptography
System.Security.Cryptography.X509Certificate
System.Security.Cryptography.Xml
All of the above
_______________ is used to maintain confidentiality, integrity, and authenticity of the sensitive information.
Cryptography
Symmetric
Asymmetric
Hashing
The use of the XML file in the application increases as it provides more flexibility in exchanging information
True
False
Hashing is used to check the integrity of the message
True
False
Super False
Choose the correct words to fill the blank
_______ signatures are used to prevent ________ file from tampering.
Note: Same word is used to fill both spaces
XML
.NET
Digital
The digital certificate is used to ...
Secure Public keys in the digital process
Check the integrity of the message
Prevent XML file from tampering
Maintain confidentially
What does the secret manager tool do?
Stores sensitive data on the local system
Can read secrets stored
Stores secrets on your local machine
All of the above
None of the above
What does configure the data protection system to alter the default cryptographic algorithms used to generate protected payload?
UseCryptographicAlgorithms
System.Security.Cryptography
Hashing String
Multiple applications using the same physical key repository are isolated from each other by: _____________
IDataProtector
App isolation
Data Protection System
Extract environment variables values by calling _______________
Vulnerable Code
AddEnvironmentVariables
Hashing String
What does include ASP.NET Core to protect data?
Data protection API
System.Security.Cryptography.Xml
Trusted Intermediary solution
Which are the basic areas of cryptography?
Symmetric encryption
Asymmetric encryption
Hashing
Digital Signatures
All of the above
