Back to Subject

Unit 4: Asp.Net MVC and Security - Practice Quiz

INT402 — Modern Web Programming Tools And Techniques 60 Questions
0 Correct 0 Wrong 60 Left
0/60

1 What is the middleware request pipeline in ASP.NET Core?

Middleware Request Pipeline Easy
A. A collection of tables that stores application data
B. A service that creates database connections
C. A sequence of components that processes HTTP requests and responses
D. A tool that compiles C# code into HTML

2 Why is the order of middleware components important in ASP.NET Core?

Middleware Request Pipeline Easy
A. Each component creates a separate database automatically
B. Each component runs according to its position in the pipeline
C. Each component changes the application's programming language
D. Each component runs only when the server is stopped

3 Which method can terminate the middleware pipeline by writing a response without calling the next component?

Middleware Request Pipeline Easy
A. Use
B. Map
C. Build
D. Run

4 Which built-in middleware is commonly used to serve CSS, JavaScript, and image files?

Built-In Middleware and Custom Middleware Easy
A. Routing Middleware
B. Static Files Middleware
C. Session Middleware
D. Authorization Middleware

5 Which method is commonly used to add a custom inline middleware component to the pipeline?

Built-In Middleware and Custom Middleware Easy
A. app.Build
B. app.Create
C. app.Use
D. app.Start

6 What method is usually called inside custom middleware to pass control to the next component?

Built-In Middleware and Custom Middleware Easy
A. ConfigureAsync on the application
B. RegisterAsync on the service collection
C. ConnectAsync on the database context
D. InvokeAsync on the next delegate

7 What is Dependency Injection?

Dependency Injection (DI) Easy
A. A technique for supplying an object's required dependencies
B. A technique for converting HTML into C# code
C. A technique for routing URLs to static files
D. A technique for encrypting data stored in tables

8 What is a key benefit of Dependency Injection?

Dependency Injection (DI) Easy
A. It reduces tight coupling between classes
B. It converts databases into source code
C. It prevents every type of security attack
D. It removes the need for HTTP requests

9 Which type is commonly used to define a dependency contract in C#?

Dependency Injection (DI) Easy
A. Interface
B. Enumeration
C. Attribute
D. Namespace

10 Where are application services registered in a modern ASP.NET Core application?

Implementing DI in ASP.NET Core Easy
A. builder.Logging
B. app.Environment
C. builder.Services
D. app.Configuration

11 Which service lifetime creates one instance for each HTTP request?

Implementing DI in ASP.NET Core Easy
A. Singleton
B. Scoped
C. Static
D. Transient

12 Which method registers a service that uses one instance for the application's lifetime?

Implementing DI in ASP.NET Core Easy
A. AddTransient
B. AddSingleton
C. AddControllers
D. AddScoped

13 In the Code First approach, what is typically created first?

Developing Application with Code First Approach Easy
A. Database views
B. Database tables
C. Stored procedures
D. Entity classes

14 What does an Entity Framework Core migration represent?

Developing Application with Code First Approach Easy
A. A list of middleware components
B. A collection of HTTP responses
C. A set of user login attempts
D. A set of database schema changes

15 Which command creates a new Entity Framework Core migration?

Developing Application with Code First Approach Easy
A. dotnet ef migrations add
B. dotnet ef database drop
C. dotnet ef dbcontext list
D. dotnet ef migrations remove

16 In the Database First approach, what already exists before entity classes are generated?

Developing Application with Database First Approach Easy
A. Controller routes
B. Authorization policy
C. Middleware pipeline
D. Database schema

17 What is scaffolding in the Entity Framework Core Database First approach?

Developing Application with Database First Approach Easy
A. Generating passwords from authorization roles
B. Generating entity classes from an existing database
C. Generating database records from HTTP requests
D. Generating middleware from controller methods

18 What does authentication determine in a web application?

Authentication and Authorization in Web Application Easy
A. How database tables are created
B. When middleware is registered
C. Which page layout to use
D. Who the user is

19 What does authorization determine in a web application?

Authentication and Authorization in Web Application Easy
A. Where static files are stored
B. What an authenticated user may access
C. How an entity class is compiled
D. Whether the database server is running

20 Which ASP.NET Core attribute is commonly used to restrict access to a controller or action?

Authentication and Authorization in Web Application Easy
A. [Route]
B. [Authorize]
C. [ValidateAntiForgeryToken]
D. [HttpGet]

21 A middleware checks whether an API key is present. If the key is missing, it writes a 401 response and does not call the next middleware. What behavior does this demonstrate?

Middleware Request Pipeline Medium
A. Endpoint route matching
B. Service scope creation
C. Pipeline short-circuiting
D. Response body buffering

22 An application should handle exceptions thrown by all later middleware components. Where should UseExceptionHandler normally be placed?

Middleware Request Pipeline Medium
A. Inside each controller action
B. Immediately after endpoint execution
C. Near the beginning of the pipeline
D. After the application has started

23 Which middleware order correctly enables endpoint-aware authentication and authorization for controller routes?

Middleware Request Pipeline Medium
A. UseAuthentication, MapControllers, UseRouting, UseAuthorization
B. UseAuthorization, UseRouting, UseAuthentication, MapControllers
C. MapControllers, UseRouting, UseAuthorization, UseAuthentication
D. UseRouting, UseAuthentication, UseAuthorization, MapControllers

24 A custom logging middleware must record both the incoming request and the final response status code. Which implementation pattern should it use?

Built-In Middleware and Custom Middleware Medium
A. Log before and after await _next(context)
B. Call _next(context) without awaiting it
C. Log only inside the middleware constructor
D. Log twice before calling _next(context)

25 A class named RequestTimingMiddleware follows the conventional middleware pattern. How should it normally be added to the pipeline?

Built-In Middleware and Custom Middleware Medium
A. app.MapControllers<RequestTimingMiddleware>()
B. app.UseMiddleware<RequestTimingMiddleware>()
C. app.RunMiddleware<RequestTimingMiddleware>()
D. builder.Services.Use<RequestTimingMiddleware>()

26 Static files in wwwroot should be served without reaching MVC controllers. Which built-in middleware provides this behavior?

Built-In Middleware and Custom Middleware Medium
A. UseAuthorization
B. UseStaticFiles
C. UseStatusCodePages
D. UseRouting

27 A service should maintain one instance during a single HTTP request but use a different instance for the next request. Which DI lifetime is appropriate?

Dependency Injection (DI) Medium
A. Transient
B. Static
C. Scoped
D. Singleton

28 A singleton service directly receives a scoped repository through constructor injection. What is the main design problem?

Dependency Injection (DI) Medium
A. The scoped dependency may outlive its intended scope
B. The constructor can no longer be discovered
C. The repository becomes automatically transient
D. The singleton is recreated for every request

29 Why is injecting IEmailSender generally preferable to constructing SmtpEmailSender directly inside a controller?

Dependency Injection (DI) Medium
A. It prevents all runtime email failures
B. It automatically encrypts configuration values
C. It guarantees asynchronous email delivery
D. It supports replacement and isolated testing

30 Which registration creates one OrderService instance per HTTP request when IOrderService is injected?

Implementing DI in ASP.NET Core Medium
A. builder.Services.AddScoped<IOrderService, OrderService>()
B. builder.Services.AddSingleton<IOrderService, OrderService>()
C. builder.Services.AddTransient<IOrderService, OrderService>()
D. builder.Services.Configure<IOrderService, OrderService>()

31 A controller constructor requires IProductRepository, but the application throws an error stating that the service cannot be resolved. What is the most likely correction?

Implementing DI in ASP.NET Core Medium
A. Create the repository in launchSettings.json
B. Mark the controller constructor as static
C. Add the repository to app.UseRouting
D. Register the repository in builder.Services

32 A conventional middleware needs a scoped DbContext for each request. Which approach avoids capturing it for the application's lifetime?

Implementing DI in ASP.NET Core Medium
A. Inject the DbContext into InvokeAsync
B. Create the DbContext in the middleware constructor
C. Register the DbContext as a singleton
D. Store the DbContext in a static field

33 A developer adds a Price property to the Product entity in an EF Core Code First application. What should normally be done to update the database schema?

Developing Application with Code First Approach Medium
A. Delete the DbContext and restart
B. Add a migration and update the database
C. Modify only the connection string
D. Rescaffold the model from the database

34 Which command sequence correctly creates and applies an EF Core migration named AddCategory?

Developing Application with Code First Approach Medium
A. dotnet ef migrations remove, then dotnet ef database update AddCategory
B. dotnet ef dbcontext scaffold AddCategory, then dotnet ef database drop
C. dotnet ef migrations add AddCategory, then dotnet ef database update
D. dotnet ef database update, then dotnet ef migrations add AddCategory

35 An Order entity contains CustomerId and a Customer navigation property. What does EF Core conventionally infer?

Developing Application with Code First Approach Medium
A. CustomerId is a foreign key for the relationship
B. Customer must be stored as a text column
C. Order and Customer are unrelated entities
D. CustomerId is the primary key of Order

36 A database already contains tables and relationships, and the application needs EF Core entity classes generated from it. Which operation should be used?

Developing Application with Database First Approach Medium
A. Create an empty Code First migration
B. Register all tables as singleton services
C. Scaffold the DbContext and entity classes
D. Generate controllers before entity classes

37 Which EF Core CLI command is used to reverse-engineer a SQL Server database?

Developing Application with Database First Approach Medium
A. dotnet ef migrations add <connection> Microsoft.EntityFrameworkCore.SqlServer
B. dotnet ef dbcontext scaffold <connection> Microsoft.EntityFrameworkCore.SqlServer
C. dotnet ef dbcontext optimize <connection> Microsoft.EntityFrameworkCore.SqlServer
D. dotnet ef database update <connection> Microsoft.EntityFrameworkCore.SqlServer

38 A developer expects to re-scaffold entity classes after database changes. Where should custom business logic preferably be placed to reduce the risk of losing it?

Developing Application with Database First Approach Medium
A. Inside the generated entity constructors
B. Directly inside the scaffolded DbContext
C. Inside the database connection string
D. In partial classes separate from generated files

39 A user has successfully signed in but is denied access because an action requires the Admin role. Which security process caused the denial?

Authentication and Authorization in Web Application Medium
A. Session creation
B. Authorization
C. Route matching
D. Authentication

40 What is the expected distinction when accessing a protected API endpoint?

Authentication and Authorization in Web Application Medium
A. Both users always receive the same successful response
B. Both users are always treated as successfully authenticated
C. An unauthenticated user is challenged, while an unauthorized authenticated user is forbidden
D. An unauthenticated user is forbidden, while an unauthorized authenticated user is redirected

41 In an ASP.NET Core pipeline, middleware A calls await _next(context) and then adds a response header. Middleware B, registered after A, writes the response body and also calls its next delegate. Which statement best describes the execution order?

Middleware Request Pipeline Hard
A. A executes after B and adds its header before B starts
B. B completes entirely before A begins processing the request
C. A executes before B and adds its header after B completes
D. A and B execute concurrently because both use asynchronous delegates

42 A middleware must guarantee that a correlation ID is available to all downstream components and is also included in the final response header. Where should the response-header assignment normally occur?

Middleware Request Pipeline Hard
A. After calling _next, inside a finally block
B. Inside the endpoint, after the response body is generated
C. After calling _next, inside a try block
D. Before calling _next, after creating the correlation ID

43 A terminal middleware is registered before UseRouting() and writes a 200 OK response without invoking its next delegate. What is the most likely result for endpoint routing?

Middleware Request Pipeline Hard
A. Routing still selects an endpoint because middleware order is irrelevant
B. Routing runs only when endpoint authorization is configured
C. Routing runs automatically after the response body is written
D. Routing does not run because the terminal middleware short-circuits

44 An ASP.NET Core application uses endpoint authorization policies. Which ordering is required for authorization to evaluate the selected endpoint's metadata correctly?

Built-In Middleware and Custom Middleware Hard
A. UseRouting() before UseAuthorization()
B. UseAuthorization() after MapControllers() only
C. UseRouting() after UseAuthorization() and UseEndpoints()
D. UseAuthorization() before UseRouting()

45 A custom exception-handling middleware is intended to convert unhandled downstream exceptions into JSON responses. Which implementation detail is essential?

Built-In Middleware and Custom Middleware Hard
A. It must call UseExceptionHandler() inside every request
B. It must be registered after the endpoint middleware
C. It must surround _next(context) with exception handling
D. It must write the JSON response before invoking _next(context)

46 A custom middleware is registered with app.UseMiddleware<RequestAuditMiddleware>(). The middleware constructor directly receives a repository registered as scoped. What is the principal lifetime risk?

Built-In Middleware and Custom Middleware Hard
A. The repository cannot access the current request scope
B. The repository is automatically promoted to transient lifetime
C. The repository may be captured by a singleton middleware instance
D. The repository is recreated for every method call

47 A service registered as transient depends on a service registered as scoped. The transient service is resolved repeatedly within one HTTP request. What behavior should be expected?

Dependency Injection (DI) Hard
A. The application fails because transient services cannot depend on scoped services
B. A new scoped dependency is created for every transient resolution
C. The same scoped dependency is reused within the request scope
D. The scoped dependency is promoted to singleton lifetime

48 A singleton service directly depends on a scoped DbContext, and scope validation is enabled in development. What is the expected outcome?

Dependency Injection (DI) Hard
A. The singleton receives a new context for every query
B. The context is silently changed to transient lifetime
C. The scoped context is safely cached by the singleton
D. Service provider validation reports an invalid lifetime dependency

49 An interface has three registered implementations, but a consumer requests IEnumerable<IProcessor>. Which result does the default ASP.NET Core container provide?

Dependency Injection (DI) Hard
A. An exception unless a keyed service is configured
B. All registered implementations in registration order
C. Only the first registered implementation
D. Only the last registered implementation

50 A controller accepts IOptionsSnapshot<AppSettings>, while a singleton background service accepts IOptions<AppSettings>. Configuration is reloaded at runtime. Which statement is correct?

Implementing DI in ASP.NET Core Hard
A. The singleton automatically receives a new options object per request
B. The snapshot is valid only when the application uses transient services
C. The snapshot can reflect changes per scope, while the singleton option is generally fixed
D. Both services always see the same value until application restart

51 A hosted background service needs to query a scoped DbContext every minute. Which design is appropriate?

Implementing DI in ASP.NET Core Hard
A. Create an IServiceScope for each iteration and resolve the context inside it
B. Resolve the DbContext from the root provider and reuse it
C. Inject the DbContext directly into the hosted service constructor
D. Register the DbContext as singleton for background execution

52 A service is registered using services.AddSingleton<IClock, SystemClock>(), and a controller requests SystemClock directly rather than IClock. What happens with the default container?

Implementing DI in ASP.NET Core Hard
A. The controller receives the same singleton automatically
B. Resolution fails because only the service type IClock was registered
C. Resolution succeeds only when constructor injection is disabled
D. The controller receives a transient SystemClock automatically

53 In EF Core Code First, a required Order.Customer navigation is added to the model, but the migration unexpectedly creates a nullable foreign-key column. Which cause is most plausible?

Developing Application with Code First Approach Hard
A. The entity derives from DbContext
B. The migration was generated before the model was compiled
C. The navigation property is marked virtual
D. The foreign-key property uses a nullable type

54 A Code First migration is generated successfully, but applying it fails because a new non-nullable column is added to a populated table without a default. What is the sound migration strategy?

Developing Application with Code First Approach Hard
A. Delete the migration and ignore the new property
B. Run the migration repeatedly until the provider supplies values
C. Mark the property as [NotMapped] and retain the migration
D. Add the column as nullable, backfill values, then make it required

55 An EF Core query loads an aggregate, changes a child entity, and calls SaveChanges(). The child was queried through the same tracking DbContext. What usually allows EF Core to persist the child update without an explicit Update call?

Developing Application with Code First Approach Hard
A. The navigation property forces every child to be inserted
B. The change tracker detects the modified child state
C. The database automatically tracks all object changes
D. SaveChanges() updates only entities attached as Added

56 A database-first EF Core model is scaffolded from a database. A developer manually edits the generated entity class, then scaffolds again after a schema change. What is the safest customization approach?

Developing Application with Database First Approach Hard
A. Keep all custom logic directly in generated files
B. Use partial classes and separate configuration files
C. Copy generated classes into controller files
D. Disable schema changes after the first scaffold

57 A database-first application must query a view that has no primary key and is read-only. How should the EF Core model represent it?

Developing Application with Database First Approach Hard
A. As a tracked entity with identity resolution enabled
B. As a keyless entity mapped to the view
C. As an owned entity with a generated key
D. As a normal entity with an invented key

58 An ASP.NET Core application uses cookie authentication and has an [Authorize(Roles = "Manager")] action. An authenticated user has a valid cookie but lacks the Manager role. What response is expected?

Authentication and Authorization in Web Application Hard
A. The application redirects to login because roles are checked before authentication
B. The application returns 401 Unauthorized because the cookie is invalid
C. The action executes because authentication implies authorization
D. The application returns 403 Forbidden because the user is authenticated but disallowed

59 A JWT bearer token is validly signed and unexpired, but its aud claim does not match the API's configured audience. What should the API do?

Authentication and Authorization in Web Application Hard
A. Accept it because signature validation is sufficient
B. Refresh it automatically using the signing key
C. Reject it because audience validation fails
D. Accept it if the subject claim contains a user ID

60 A policy requires a claim named scope with value orders.read. The token contains scope as the single string orders.read orders.write. What configuration or transformation is needed for the policy to work as intended?

Authentication and Authorization in Web Application Hard
A. Replace the scope value with the token's issuer
B. Convert the scope value into an integer claim
C. Split the space-delimited scope into separate claims
D. Disable claim validation for bearer authentication
Previous MCQ
Unit 3
Next MCQ
Unit 5