Posted by
p4ss1887 on Wednesday, August 26, 2009 1:49:46 AM
1.You are an application developer for your company. You develop an ASP.NET Web application that is
installed on a server named Server1. Server1 has IIS 5.0 installed. The Web application is configured to
use Anonymous authentication in IIS.
The Web.config file contains the following code segment.
<authentication mode="Windows" />
<identity impersonate="true" />
The Machine.config file contains the following code segment.
<authentication mode="Windows" />
The application implements security based on the following code segment.
Dim myIdentity As String
Dim validAccess As Integer
validAccess = 0
myIdentity = WindowsIdentity.GetCurrent().Name.ToString()
If (myIdentity = "Server1\ASPNET") Then
validAccess = 1
End If
For testing purposes, you display the value of the validAccess variable in a label. When you run the
application, you discover that the value of validAccess is 0.
You need to ensure that validAccess has a value of 1.
What should you do?
A: Replace the code segment in the Web.config file with the following code segment. <authentication
mode="Windows" /><identity impersonate="false" />
B: Replace the code segment in the Web.config file with the following code segment. <authentication
mode="Forms" /><identity impersonate="true" />
C: Ask a network administrator to change the authentication mode of the Web application to Integrated
Windows authentication.
D: Ask a network administrator to change the authentication mode of the Web application to basic
authentication.
Correct Answers: A
70-297 70-431 70-433
2.You are an application developer for your company. Users who are temporary employees are members of a
group named TemporaryEmployees. You develop a serviced component named MyComponent. MyComponent is part
of a COM+ application named MyApplication. MyComponent is secured by using the SecurityRole attribute for
the Employees role. You need to ensure that members of the TemporaryEmployees group are assigned to the
Employees role. You decide to add the TemporaryEmployees group to the existing Employees role. Which tool
should you use?
A: the Code Access Security Policy tool
B: the Permissions View tool
C: the Component Services tool
D: the Secutil tool
E: the Microsoft .NET Framework Configuration tool
Correct Answers: C
3.You are an application developer for your company. You develop a Windows Forms application. You set a
breakpoint in the code and run the application. You receive an error message stating that you are unable
to start debugging. You need to be able to debug the application without having more authority than
necessary. What should you do?
A: Add your user account to the local Debugger Users group.
B: Grant your user account complete control of the executable file for the application.
C: Modify the code access security policy to run the Microsoft Visual Studio .NET debugger with the
FullTrust permission.
D: Run Microsoft Visual Studio .NET 2003 by using the runas command and specify a user account in the
Power Users group.
Correct Answers: B
4.You are an application developer for your company. You develop an ASP.NET Web application that writes
to an event log named EventLog1. All managers in your company will run this application. During a test on
a manager's client computer, the application fails in the following code segment. (Line numbers are
included for reference only.)
1 Dim EventLog1 As New EventLog
2 If Not EventLog.SourceExists("MyWebApp") Then
3 EventLog.CreateEventSource("MyWebApp", "Application")
4 End If
5 EventLog1.Source = "MyWebApp"
6 EventLog1.WriteEntry("The event occurred.")
You need to ensure that event data is written to EventLog1. You want to achieve this goal without
granting unnecessary permissions.
What should you do?
A: Insert the following code into the application. Dim eventLogDir As StringeventLogDir = "C:\%windir%
\system32\config\AppEvent.Evt"Dim FilePermission As _ New FileIOPermission
(FileIOPermissionAccess.AllAccess, eventLogDir)FilePermission.Assert()
B: Replace line 6 of the code segment with the following line of code. EventLog1.WriteEntry("The event
occurred","EventLogWriter")
C: Grant the managers the Full Control permission for the event log file.
D: Add the aspnet_wp account to the Administrators group.
E: Create the event log source in the installer class of the application.
Correct Answers: E
70-450 70-536 70-646
5.You are an application developer for your company. You are developing a Windows Forms application. You
deploy a supporting assembly named MyAssembly.dll to the global assembly cache. During testing, you
discover that the application is prevented from accessing MyAssembly.dll.
You need to ensure that the application can access MyAssembly.dll.
What should you do?
A: Digitally sign the application by using a digital certificate.
B: Run the caspol.exe -s on command from the command line.
C: Run the Assembly Linker to link MyAssembly.dll to the application.
D: Modify the security policy to grant the application the FullTrust permission.
Correct Answers: D
6.You are an application developer for your company. You create an ASP.NET Web application. The
application allows customers to select items for purchase. During the active session of a customer, data
about the quantity and price of items selected by the customer is stored in a cookie on the client
computer. You need to test the application for security vulnerabilities. What should you do?
A: Test the application by using a browser that has cookies disabled.
B: Test the application by selecting 150 items for purchase.
C: Test the application by using a cookie that you create in a text editor.
D: Test the application by using the five most common Internet browsers.
Correct Answers: C
70-649 MB6-820 VCP-310
7.You are an application developer for your company. The company runs an e-commerce Web site. Users log
on to the Web site by using a password. Passwords are stored in a text file. The following code segment
prepares the passwords for storage.
Function HashPassword(ByVal Pwd As String) As String
Return FormsAuthentication.HashPasswordForStoringInConfigFile(Pwd, "SHA1")
End Function
Users of the Web site are creating passwords that are easily cracked by dictionary attacks.
You need to decrease the likelihood that a dictionary attack will succeed if the password file is stolen,
without restricting the passwords that users can create.
What should you do?
A: Create a dictionary file that contains common words. Write additional code to reject passwords that
match the entries in the dictionary.
B: Apply a more restrictive discretionary access control list (DACL) to the password storage file.
C: Replace the HashPassword function with the following code segment. Function HashPassword(ByVal Pwd As
String) As String Return FormsAuthentication.HashPasswordForStoringInConfigFile(Pwd, "MD5")End Function
D: Replace the HashPassword function with the following code segment. Function HashPassword(ByVal Pwd As
String) As String Dim Rng As New RNGCryptoServiceProvider Dim Salt(16) As Byte Rng.GetBytes(Salt) Dim
saltstr As String = Convert.ToBase64String(Salt) Return saltstr &
FormsAuthentication.HashPasswordForStoringInConfigFile( _ saltstr & Pwd, "SHA1")End Function
E: Replace the HashPassword function with the following code segment. Function HashPassword(ByVal Pwd As
String) As String Dim Hash As Integer = 0 Dim Enc As New UnicodeEncoding Dim HashData As Byte() =
Enc.GetBytes(Pwd) Dim i As Integer For i = 0 To HashData.Length Step 2 Hash = Hash Xor (HashData(i)
Or (HashData(i + 1) << 8)) Next Return Hash.ToString()End Function
Correct Answers: D
8.You are an application developer for your company. You are developing an application. Part of the
application accepts a URL from the user and stores the URL in a variable named strInput. Only URLs that
specify HTTP or FTP as the protocol are usable by the application. URLs specifying the messenger, news,
file, or other protocols are not permitted because they might allow the user to bypass certain security
features. You need to ensure that the URL provided by the user specifies only HTTP or FTP as the
protocol. What should you do?
A: Test the user's input by using the following regular expression. ^(http:|ftp:)Reject input that does
not match the regular expression.
B: Test the user's input by using the following regular expression. ^(messenger:|file:|news:)Reject input
that matches the regular expression.
C: Modify the contents of strInput so that all instances of messenger or news are replaced with http, and
all instances of file are replaced with ftp.
D: Add the following code segment to the application. If strInput.Chars(0) <> "h" And strInput.Chars(0)
<> "f" Then MsgBox "Protocol is not allowed." strInput = ""End If
E: Add the following code segment to the application. Select Case strInput Case "messenger", "news",
"file" MsgBox "Protocol is not allowed." strInput = ""End Select
Correct Answers: A
9.You are an application developer for your company. You develop a Windows Forms application. You want
your application to use a class library that was developed by another developer. You run the Permissions
View tool on the class library and receive the following output.
Microsoft (R) .NET Framework Permission Request Viewer. Version 1.1.4322.573
Copyright (C) Microsoft Corporation 1998-2002. All rights reserved.
minimal permission set:
<PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.FileIOPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Write="C:\SecureFile.txt"/>
<IPermission class="System.Security.Permissions.ReflectionPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Flags="ReflectionEmit"/>
<IPermission class="System.Security.Permissions.SecurityPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Flags="SerializationFormatter"/>
</PermissionSet>
optional permission set:
<PermissionSet class="System.Security.PermissionSet"
version="1"
Unrestricted="true"/>
refused permission set:
Not specified
You need to add the correct attributes to the Windows Forms application code before the call to the class
library. Which code segment should you use?
A: <Assembly: ReflectionPermission(SecurityAction.RequestMinimum, _ ReflectionEmit:=False), _ Assembly:
SecurityPermission(SecurityAction.RequestOptional, _ SerializationFormatter:=False), _ Assembly:
FileIOPermissionAttribute(SecurityAction.RequestRefuse, _ Write:="C:\SecureFile.txt"), _Assembly:
PermissionSetAttribute(SecurityAction.RequestOptional, Unrestricted:=True)>
B: <Assembly: ReflectionPermission(SecurityAction.RequestOptional, _ ReflectionEmit:=True), _ Assembly:
SecurityPermission(SecurityAction.RequestMinimum, _ SerializationFormatter:=True), _ Assembly:
FileIOPermissionAttribute(SecurityAction.RequestOptional, _ Write:="C:\SecureFile.txt"), _Assembly:
PermissionSetAttribute(SecurityAction.RequestMinimum, Unrestricted:=True)>
C: <Assembly: ReflectionPermission(SecurityAction.RequestMinimum, _ ReflectionEmit:=False), _ Assembly:
SecurityPermission(SecurityAction.RequestMinimum, _ SerializationFormatter:=False), _ Assembly:
FileIOPermissionAttribute(SecurityAction.RequestOptional, _ Write:="C:\SecureFile.txt"), _Assembly:
PermissionSetAttribute(SecurityAction.RequestMinimum, Unrestricted:=True)>
D: <Assembly: ReflectionPermission(SecurityAction.RequestMinimum, _ ReflectionEmit:=True), _ Assembly:
SecurityPermission(SecurityAction.RequestMinimum, _ SerializationFormatter:=True), _ Assembly:
FileIOPermissionAttribute(SecurityAction.RequestMinimum, _ Write:="C:\SecureFile.txt"), _Assembly:
PermissionSetAttribute(SecurityAction.RequestOptional, Unrestricted:=True)>
Correct Answers: D
10.You are an application developer for your company. Each client computer in the company runs either
Microsoft Windows XP Professional or Windows 98. You are developing an application that will be used by
all users in your company. Users log on to their client computers by using a domain user account that is
a member of the local Power Users group on the user's client computer. You log on to your Windows XP
Professional computer by using a domain user account that is a member of the local Administrators group
and Power Users group on your computer. When testing your application, you need to ensure that your tests
accurately reflect the production environment in which the application will run. How should you test the
application?
A: Ask a domain administrator to temporarily remove your domain user account from the local
Administrators group on your computer while you are testing the application.
B: Test the application on your computer. When testing, log on to the computer by using a domain user
account that is a member of only the local Power Users group on your computer.
C: Deploy the application to a Windows XP Professional computer and a Windows 98 computer. Log on to each
computer by using a domain user account that is a member of only the local Power Users group.
D: Compile the assemblies of the application from the command line by running the runas command and
specifying a domain user account that is a member of only the local Power Users group on your computer.
Correct Answers: C