Back to Subject

Unit 4: Asp.Net MVC and Security - Practice Quiz

INT402 — Modern Web Programming Tools And Techniques 60 Questions
0 Correct 0 Wrong 60 Left
0/60

1 What is the middleware request pipeline in ASP.NET Core?

Middleware Request Pipeline Easy
A. A collection of tables that stores application data
B. A service that creates database connections
C. A sequence of components that processes HTTP requests and responses
D. A tool that compiles C# code into HTML

2 Why is the order of middleware components important in ASP.NET Core?

Middleware Request Pipeline Easy
A. Each component creates a separate database automatically
B. Each component changes the application's programming language
C. Each component runs only when the server is stopped
D. Each component runs according to its position in the pipeline

3 Which method can terminate the middleware pipeline by writing a response without calling the next component?

Middleware Request Pipeline Easy
A. Build
B. Use
C. Map
D. Run

4 Which built-in middleware is commonly used to serve CSS, JavaScript, and image files?

Built-In Middleware and Custom Middleware Easy
A. Authorization Middleware
B. Routing Middleware
C. Static Files Middleware
D. Session Middleware

5 Which method is commonly used to add a custom inline middleware component to the pipeline?

Built-In Middleware and Custom Middleware Easy
A. app.Build
B. app.Create
C. app.Use
D. app.Start

6 What method is usually called inside custom middleware to pass control to the next component?

Built-In Middleware and Custom Middleware Easy
A. InvokeAsync on the next delegate
B. ConnectAsync on the database context
C. RegisterAsync on the service collection
D. ConfigureAsync on the application

7 What is Dependency Injection?

Dependency Injection (DI) Easy
A. A technique for converting HTML into C# code
B. A technique for routing URLs to static files
C. A technique for supplying an object's required dependencies
D. A technique for encrypting data stored in tables

8 What is a key benefit of Dependency Injection?

Dependency Injection (DI) Easy
A. It removes the need for HTTP requests
B. It reduces tight coupling between classes
C. It prevents every type of security attack
D. It converts databases into source code

9 Which type is commonly used to define a dependency contract in C#?

Dependency Injection (DI) Easy
A. Interface
B. Namespace
C. Enumeration
D. Attribute

10 Where are application services registered in a modern ASP.NET Core application?

Implementing DI in ASP.NET Core Easy
A. app.Configuration
B. builder.Logging
C. builder.Services
D. app.Environment

11 Which service lifetime creates one instance for each HTTP request?

Implementing DI in ASP.NET Core Easy
A. Transient
B. Singleton
C. Static
D. Scoped

12 Which method registers a service that uses one instance for the application's lifetime?

Implementing DI in ASP.NET Core Easy
A. AddScoped
B. AddControllers
C. AddSingleton
D. AddTransient

13 In the Code First approach, what is typically created first?

Developing Application with Code First Approach Easy
A. Database tables
B. Entity classes
C. Database views
D. Stored procedures

14 What does an Entity Framework Core migration represent?

Developing Application with Code First Approach Easy
A. A list of middleware components
B. A set of user login attempts
C. A collection of HTTP responses
D. A set of database schema changes

15 Which command creates a new Entity Framework Core migration?

Developing Application with Code First Approach Easy
A. dotnet ef dbcontext list
B. dotnet ef migrations add
C. dotnet ef database drop
D. dotnet ef migrations remove

16 In the Database First approach, what already exists before entity classes are generated?

Developing Application with Database First Approach Easy
A. Database schema
B. Authorization policy
C. Middleware pipeline
D. Controller routes

17 What is scaffolding in the Entity Framework Core Database First approach?

Developing Application with Database First Approach Easy
A. Generating passwords from authorization roles
B. Generating middleware from controller methods
C. Generating database records from HTTP requests
D. Generating entity classes from an existing database

18 What does authentication determine in a web application?

Authentication and Authorization in Web Application Easy
A. When middleware is registered
B. How database tables are created
C. Who the user is
D. Which page layout to use

19 What does authorization determine in a web application?

Authentication and Authorization in Web Application Easy
A. How an entity class is compiled
B. Whether the database server is running
C. Where static files are stored
D. What an authenticated user may access

20 Which ASP.NET Core attribute is commonly used to restrict access to a controller or action?

Authentication and Authorization in Web Application Easy
A. [Route]
B. [ValidateAntiForgeryToken]
C. [Authorize]
D. [HttpGet]

21 A middleware checks whether an API key is present. If the key is missing, it writes a 401 response and does not call the next middleware. What behavior does this demonstrate?

Middleware Request Pipeline Medium
A. Endpoint route matching
B. Response body buffering
C. Service scope creation
D. Pipeline short-circuiting

22 An application should handle exceptions thrown by all later middleware components. Where should UseExceptionHandler normally be placed?

Middleware Request Pipeline Medium
A. Inside each controller action
B. Immediately after endpoint execution
C. Near the beginning of the pipeline
D. After the application has started

23 Which middleware order correctly enables endpoint-aware authentication and authorization for controller routes?

Middleware Request Pipeline Medium
A. MapControllers, UseRouting, UseAuthorization, UseAuthentication
B. UseRouting, UseAuthentication, UseAuthorization, MapControllers
C. UseAuthorization, UseRouting, UseAuthentication, MapControllers
D. UseAuthentication, MapControllers, UseRouting, UseAuthorization

24 A custom logging middleware must record both the incoming request and the final response status code. Which implementation pattern should it use?

Built-In Middleware and Custom Middleware Medium
A. Log before and after await _next(context)
B. Log twice before calling _next(context)
C. Log only inside the middleware constructor
D. Call _next(context) without awaiting it

25 A class named RequestTimingMiddleware follows the conventional middleware pattern. How should it normally be added to the pipeline?

Built-In Middleware and Custom Middleware Medium
A. app.UseMiddleware<RequestTimingMiddleware>()
B. app.MapControllers<RequestTimingMiddleware>()
C. app.RunMiddleware<RequestTimingMiddleware>()
D. builder.Services.Use<RequestTimingMiddleware>()

26 Static files in wwwroot should be served without reaching MVC controllers. Which built-in middleware provides this behavior?

Built-In Middleware and Custom Middleware Medium
A. UseStatusCodePages
B. UseRouting
C. UseAuthorization
D. UseStaticFiles

27 A service should maintain one instance during a single HTTP request but use a different instance for the next request. Which DI lifetime is appropriate?

Dependency Injection (DI) Medium
A. Singleton
B. Scoped
C. Static
D. Transient

28 A singleton service directly receives a scoped repository through constructor injection. What is the main design problem?

Dependency Injection (DI) Medium
A. The repository becomes automatically transient
B. The scoped dependency may outlive its intended scope
C. The constructor can no longer be discovered
D. The singleton is recreated for every request

29 Why is injecting IEmailSender generally preferable to constructing SmtpEmailSender directly inside a controller?

Dependency Injection (DI) Medium
A. It guarantees asynchronous email delivery
B. It supports replacement and isolated testing
C. It automatically encrypts configuration values
D. It prevents all runtime email failures

30 Which registration creates one OrderService instance per HTTP request when IOrderService is injected?

Implementing DI in ASP.NET Core Medium
A. builder.Services.Configure<IOrderService, OrderService>()
B. builder.Services.AddSingleton<IOrderService, OrderService>()
C. builder.Services.AddScoped<IOrderService, OrderService>()
D. builder.Services.AddTransient<IOrderService, OrderService>()

31 A controller constructor requires IProductRepository, but the application throws an error stating that the service cannot be resolved. What is the most likely correction?

Implementing DI in ASP.NET Core Medium
A. Mark the controller constructor as static
B. Add the repository to app.UseRouting
C. Create the repository in launchSettings.json
D. Register the repository in builder.Services

32 A conventional middleware needs a scoped DbContext for each request. Which approach avoids capturing it for the application's lifetime?

Implementing DI in ASP.NET Core Medium
A. Register the DbContext as a singleton
B. Create the DbContext in the middleware constructor
C. Inject the DbContext into InvokeAsync
D. Store the DbContext in a static field

33 A developer adds a Price property to the Product entity in an EF Core Code First application. What should normally be done to update the database schema?

Developing Application with Code First Approach Medium
A. Modify only the connection string
B. Rescaffold the model from the database
C. Delete the DbContext and restart
D. Add a migration and update the database

34 Which command sequence correctly creates and applies an EF Core migration named AddCategory?

Developing Application with Code First Approach Medium
A. dotnet ef migrations add AddCategory, then dotnet ef database update
B. dotnet ef dbcontext scaffold AddCategory, then dotnet ef database drop
C. dotnet ef database update, then dotnet ef migrations add AddCategory
D. dotnet ef migrations remove, then dotnet ef database update AddCategory

35 An Order entity contains CustomerId and a Customer navigation property. What does EF Core conventionally infer?

Developing Application with Code First Approach Medium
A. CustomerId is the primary key of Order
B. CustomerId is a foreign key for the relationship
C. Customer must be stored as a text column
D. Order and Customer are unrelated entities

36 A database already contains tables and relationships, and the application needs EF Core entity classes generated from it. Which operation should be used?

Developing Application with Database First Approach Medium
A. Generate controllers before entity classes
B. Scaffold the DbContext and entity classes
C. Register all tables as singleton services
D. Create an empty Code First migration

37 Which EF Core CLI command is used to reverse-engineer a SQL Server database?

Developing Application with Database First Approach Medium
A. dotnet ef dbcontext scaffold <connection> Microsoft.EntityFrameworkCore.SqlServer
B. dotnet ef migrations add <connection> Microsoft.EntityFrameworkCore.SqlServer
C. dotnet ef dbcontext optimize <connection> Microsoft.EntityFrameworkCore.SqlServer
D. dotnet ef database update <connection> Microsoft.EntityFrameworkCore.SqlServer

38 A developer expects to re-scaffold entity classes after database changes. Where should custom business logic preferably be placed to reduce the risk of losing it?

Developing Application with Database First Approach Medium
A. Directly inside the scaffolded DbContext
B. Inside the database connection string
C. Inside the generated entity constructors
D. In partial classes separate from generated files

39 A user has successfully signed in but is denied access because an action requires the Admin role. Which security process caused the denial?

Authentication and Authorization in Web Application Medium
A. Authorization
B. Route matching
C. Authentication
D. Session creation

40 What is the expected distinction when accessing a protected API endpoint?

Authentication and Authorization in Web Application Medium
A. An unauthenticated user is forbidden, while an unauthorized authenticated user is redirected
B. Both users always receive the same successful response
C. An unauthenticated user is challenged, while an unauthorized authenticated user is forbidden
D. Both users are always treated as successfully authenticated

41 In an ASP.NET Core pipeline, middleware A calls await _next(context) and then adds a response header. Middleware B, registered after A, writes the response body and also calls its next delegate. Which statement best describes the execution order?

Middleware Request Pipeline Hard
A. A executes before B and adds its header after B completes
B. A and B execute concurrently because both use asynchronous delegates
C. B completes entirely before A begins processing the request
D. A executes after B and adds its header before B starts

42 A middleware must guarantee that a correlation ID is available to all downstream components and is also included in the final response header. Where should the response-header assignment normally occur?

Middleware Request Pipeline Hard
A. Inside the endpoint, after the response body is generated
B. Before calling _next, after creating the correlation ID
C. After calling _next, inside a finally block
D. After calling _next, inside a try block

43 A terminal middleware is registered before UseRouting() and writes a 200 OK response without invoking its next delegate. What is the most likely result for endpoint routing?

Middleware Request Pipeline Hard
A. Routing still selects an endpoint because middleware order is irrelevant
B. Routing runs only when endpoint authorization is configured
C. Routing does not run because the terminal middleware short-circuits
D. Routing runs automatically after the response body is written

44 An ASP.NET Core application uses endpoint authorization policies. Which ordering is required for authorization to evaluate the selected endpoint's metadata correctly?

Built-In Middleware and Custom Middleware Hard
A. UseAuthorization() after MapControllers() only
B. UseRouting() before UseAuthorization()
C. UseRouting() after UseAuthorization() and UseEndpoints()
D. UseAuthorization() before UseRouting()

45 A custom exception-handling middleware is intended to convert unhandled downstream exceptions into JSON responses. Which implementation detail is essential?

Built-In Middleware and Custom Middleware Hard
A. It must be registered after the endpoint middleware
B. It must surround _next(context) with exception handling
C. It must call UseExceptionHandler() inside every request
D. It must write the JSON response before invoking _next(context)

46 A custom middleware is registered with app.UseMiddleware<RequestAuditMiddleware>(). The middleware constructor directly receives a repository registered as scoped. What is the principal lifetime risk?

Built-In Middleware and Custom Middleware Hard
A. The repository may be captured by a singleton middleware instance
B. The repository is automatically promoted to transient lifetime
C. The repository cannot access the current request scope
D. The repository is recreated for every method call

47 A service registered as transient depends on a service registered as scoped. The transient service is resolved repeatedly within one HTTP request. What behavior should be expected?

Dependency Injection (DI) Hard
A. The application fails because transient services cannot depend on scoped services
B. The same scoped dependency is reused within the request scope
C. The scoped dependency is promoted to singleton lifetime
D. A new scoped dependency is created for every transient resolution

48 A singleton service directly depends on a scoped DbContext, and scope validation is enabled in development. What is the expected outcome?

Dependency Injection (DI) Hard
A. The scoped context is safely cached by the singleton
B. The singleton receives a new context for every query
C. The context is silently changed to transient lifetime
D. Service provider validation reports an invalid lifetime dependency

49 An interface has three registered implementations, but a consumer requests IEnumerable<IProcessor>. Which result does the default ASP.NET Core container provide?

Dependency Injection (DI) Hard
A. Only the first registered implementation
B. An exception unless a keyed service is configured
C. All registered implementations in registration order
D. Only the last registered implementation

50 A controller accepts IOptionsSnapshot<AppSettings>, while a singleton background service accepts IOptions<AppSettings>. Configuration is reloaded at runtime. Which statement is correct?

Implementing DI in ASP.NET Core Hard
A. The snapshot can reflect changes per scope, while the singleton option is generally fixed
B. The singleton automatically receives a new options object per request
C. Both services always see the same value until application restart
D. The snapshot is valid only when the application uses transient services

51 A hosted background service needs to query a scoped DbContext every minute. Which design is appropriate?

Implementing DI in ASP.NET Core Hard
A. Inject the DbContext directly into the hosted service constructor
B. Register the DbContext as singleton for background execution
C. Resolve the DbContext from the root provider and reuse it
D. Create an IServiceScope for each iteration and resolve the context inside it

52 A service is registered using services.AddSingleton<IClock, SystemClock>(), and a controller requests SystemClock directly rather than IClock. What happens with the default container?

Implementing DI in ASP.NET Core Hard
A. The controller receives the same singleton automatically
B. Resolution succeeds only when constructor injection is disabled
C. The controller receives a transient SystemClock automatically
D. Resolution fails because only the service type IClock was registered

53 In EF Core Code First, a required Order.Customer navigation is added to the model, but the migration unexpectedly creates a nullable foreign-key column. Which cause is most plausible?

Developing Application with Code First Approach Hard
A. The foreign-key property uses a nullable type
B. The entity derives from DbContext
C. The migration was generated before the model was compiled
D. The navigation property is marked virtual

54 A Code First migration is generated successfully, but applying it fails because a new non-nullable column is added to a populated table without a default. What is the sound migration strategy?

Developing Application with Code First Approach Hard
A. Delete the migration and ignore the new property
B. Mark the property as [NotMapped] and retain the migration
C. Run the migration repeatedly until the provider supplies values
D. Add the column as nullable, backfill values, then make it required

55 An EF Core query loads an aggregate, changes a child entity, and calls SaveChanges(). The child was queried through the same tracking DbContext. What usually allows EF Core to persist the child update without an explicit Update call?

Developing Application with Code First Approach Hard
A. The navigation property forces every child to be inserted
B. The database automatically tracks all object changes
C. SaveChanges() updates only entities attached as Added
D. The change tracker detects the modified child state

56 A database-first EF Core model is scaffolded from a database. A developer manually edits the generated entity class, then scaffolds again after a schema change. What is the safest customization approach?

Developing Application with Database First Approach Hard
A. Use partial classes and separate configuration files
B. Keep all custom logic directly in generated files
C. Copy generated classes into controller files
D. Disable schema changes after the first scaffold

57 A database-first application must query a view that has no primary key and is read-only. How should the EF Core model represent it?

Developing Application with Database First Approach Hard
A. As a normal entity with an invented key
B. As a keyless entity mapped to the view
C. As a tracked entity with identity resolution enabled
D. As an owned entity with a generated key

58 An ASP.NET Core application uses cookie authentication and has an [Authorize(Roles = "Manager")] action. An authenticated user has a valid cookie but lacks the Manager role. What response is expected?

Authentication and Authorization in Web Application Hard
A. The application redirects to login because roles are checked before authentication
B. The application returns 403 Forbidden because the user is authenticated but disallowed
C. The action executes because authentication implies authorization
D. The application returns 401 Unauthorized because the cookie is invalid

59 A JWT bearer token is validly signed and unexpired, but its aud claim does not match the API's configured audience. What should the API do?

Authentication and Authorization in Web Application Hard
A. Reject it because audience validation fails
B. Refresh it automatically using the signing key
C. Accept it because signature validation is sufficient
D. Accept it if the subject claim contains a user ID

60 A policy requires a claim named scope with value orders.read. The token contains scope as the single string orders.read orders.write. What configuration or transformation is needed for the policy to work as intended?

Authentication and Authorization in Web Application Hard
A. Split the space-delimited scope into separate claims
B. Convert the scope value into an integer claim
C. Replace the scope value with the token's issuer
D. Disable claim validation for bearer authentication
Previous MCQ
Unit 3
Next MCQ
Unit 5