Security Questions Flashcards
What is Cross-Site Scripting (XSS)?
XSS is a vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
How can you prevent XSS attacks in ASP.NET applications?
Use input validation, output encoding, and implementing Content Security Policy (CSP).
Explain Cross-Site Request Forgery (CSRF).
CSRF is an attack where an attacker tricks a user into performing actions they didn’t intend to, often by embedding malicious requests in images or links.
What’s the purpose of using anti-forgery tokens in ASP.NET applications?
Anti-forgery tokens prevent CSRF attacks by ensuring that requests originate from the same application.
Discuss secure coding practices in .NET applications.
Secure coding practices involve input validation, proper error handling, least privilege principle, and regular security testing.
Explain the concept of SQL Injection and how to prevent it.
SQL Injection occurs when an attacker manipulates input to execute malicious SQL queries. Prevent it by using parameterized queries or ORMs.
What is OAuth, and how can it enhance security in your .NET application?
OAuth is a protocol for authorization. It enhances security by allowing third-party applications to access resources without exposing credentials.
How does the principle of “least privilege” contribute to secure coding?
Least privilege limits access rights to the minimum necessary for a user or application to perform its function, reducing attack surface.
What’s the importance of input validation in preventing security vulnerabilities?
Input validation ensures that user inputs meet expected criteria, preventing malicious data from compromising the application.
Explain the concept of “defense in depth” in software security.
Defense in depth involves implementing multiple layers of security mechanisms to protect an application, reducing the likelihood of a single point of failure.
Discuss the significance of error handling in secure coding.
Proper error handling prevents sensitive information leakage and provides attackers with less information to exploit.
How can you securely store sensitive configuration settings like API keys?
Store sensitive configuration settings in environment variables, Azure Key Vault, or using the Secret Manager tool.
What is data encryption?
Data encryption involves converting data into a secure format using algorithms to prevent unauthorized access.
Explain the difference between symmetric and asymmetric encryption.
Symmetric encryption uses a single key for both encryption and decryption, while asymmetric encryption uses a pair of keys (public and private).
How can you ensure data privacy when storing sensitive data in a database?
Use encryption to protect data at rest and in transit, and implement access controls to restrict database access.
What’s hashing, and why is it used in security practices?
Hashing is the process of converting input into a fixed-size string of characters. It’s used to securely store passwords and verify data integrity.
Discuss the purpose of a salt when hashing passwords.
A salt is random data added to the input before hashing, making it more difficult for attackers to use precomputed tables (rainbow tables) for cracking passwords.
How can you mitigate XSS vulnerabilities in ASP.NET applications?
Use ASP.NET’s built-in request validation, HTML encoding, and validation controls to prevent user inputs from being treated as code.
Explain how HttpOnly cookies help prevent XSS attacks.
HttpOnly cookies can’t be accessed through JavaScript, making it harder for attackers to steal session cookies through XSS.
What’s the difference between reflected XSS and stored XSS?
Reflected XSS involves the injection of malicious code that’s immediately reflected back to the user. Stored XSS stores the malicious code on the server for later delivery.
How can you protect your application from CSRF attacks?
Implement anti-CSRF tokens, validate Referer headers, and ensure that sensitive actions require user confirmation.
Discuss the usage of Dependency Injection in .NET applications.
Dependency Injection (DI) helps manage class dependencies by injecting them from the outside, making testing and maintenance easier.
Explain the use of async and await keywords in C#.
async and await are used for asynchronous programming, allowing non-blocking execution and improved responsiveness in applications.
What’s the purpose of the Garbage Collector in .NET?
The Garbage Collector automatically manages memory by deallocating objects that are no longer needed, preventing memory leaks.
