AKnowledge - Auditing the Knowledge

<?xml version="1.0" encoding="utf-8"?>
<Quiz>
  <Subject name="Mr. M" />
  <Knowledge area="ASP.NET Security" />
  <Mode interview="no" />
  <QuestionGroup name="Authentication / Authorization">
    <Question content="Which is the default authentication mode in ASP.NET?">
      <Answer content="Forms authentication" ok="no" />
      <Answer content="Passport authentication" ok="no" />
      <Answer content="Windows authentication" ok="yes" />
    </Question>
    <Question content="What is authorization?">
      <Answer content="The process of determining the authenticity of a user based on the user’s credentials" ok="no" />
      <Answer content="The process of determining the accessibility to a resource for a previously authenticated user" ok="yes" />
      <Answer content="The process of setting the author of a website" ok="no" />
    </Question>
    <Question content="Which of the following is not a technique used by Windows authentication?">
      <Answer content="Basic Authentication" ok="no" />
      <Answer content="Digest Authentication" ok="no" />
      <Answer content="Windows Cooperative Authentication" ok="yes" />
      <Answer content="Windows Integrated Authentication" ok="no" />
    </Question>
    <Question content="To determine if a user should have access to a file, the FileAuthorizationModule performs checks on:">
      <Answer content="Windows Access Control Lists (ACLs)" ok="yes" />
      <Answer content="Active Directory" ok="no" />
      <Answer content="Publication Access List (PAL)" ok="no" />
    </Question>
    <Question content="Forms authentication supports:">
      <Answer content="only session cookies" ok="no" />
      <Answer content="only persistent cookies" ok="no" />
      <Answer content="both session and persistent cookies" ok="yes" />
    </Question>
    <Question content="The RedirectFromLoginPage method creates an authentication ticket, which is used to:">
      <Answer content="redirect an authenticated user to the error page" ok="no" />
      <Answer content="redirect an authenticated user back to the originally requested URL or the default URL" ok="yes" />
      <Answer content="redirect an authenticated user to the first page to show after login" ok="no" />
    </Question>
    <Question content="The authentication specified in web.config is checked first by:">
      <Answer content="ASP.NET" ok="no" />
      <Answer content="IIS" ok="yes" />
    </Question>
  </QuestionGroup>

<!-- ************************************************************************************************************************ -->
  
  <QuestionGroup name="IIS">
    <Question content="IIS runs in a process named:">
      <Answer content="aspnet_wp.exe" ok="no" />
      <Answer content="iexplore.exe" ok="no" />
      <Answer content="inetinfo.exe" ok="yes" />
      <Answer content="winlogon.exe" ok="no" />
    </Question>
    <Question content="What identity is assigned to requests forwarded to ASP.NET by IIS?">
      <Answer content="the identity used by the IIS process" ok="no" />
      <Answer content="the identity of the built-in SYSTEM account" ok="no" />
      <Answer content="the identity of a specific user" ok="yes" />
    </Question>
    <Question content="Being deployed in virtual directories, Web applications allow remote clients:">
      <Answer content="to virtually access any file on the server" ok="no" />
      <Answer content="to access only files within the virtual directories on the server" ok="no" />
      <Answer content="to access only files within the virtual directories and their subdirectories on the server" ok="yes" />
      <Answer content="to define the accessible directories on the server" ok="no" />
    </Question>
    <Question content="Which of the following can be regarded as good user experience?">
      <Answer content="Require only SSL for sites, as data are protected over a secure channel" ok="no" />
      <Answer content="Make the web page redirect in case of a detected non-SSL connection" ok="yes" />
    </Question>
  </QuestionGroup>

<!-- ************************************************************************************************************************ -->
  
  <QuestionGroup name="ASP.NET">
    <Question content="Can the ASP.NET configuration provide authorization for HTML files?">
      <Answer content="Yes" ok="no" />
      <Answer content="No" ok="yes" />
    </Question>
    <Question content="Network eavesdropping occurs">
      <Answer content="when an attacker tricks you to enter information somewhere where you should not" ok="no" />
      <Answer content="when an attacker listens to network traffic in transit" ok="yes" />
      <Answer content="when an attacker attempts to gain access to a system by using a false identity" ok="no" />
      <Answer content="when an attacker attempts to modify data as it flows over a network" ok="yes" />
    </Question>
    <Question content="DoS attacks occur when">
      <Answer content="a system is flooded with traffic, becoming unable to process legitimate service requests" ok="yes" />
      <Answer content="scripts are disabled" ok="no" />
      <Answer content="an authenticated user loses the privilege to start a Windows service" ok="no" />
    </Question>
  </QuestionGroup>
</Quiz>