ASP.NET Application and Security Interview Questions Part I

1. Security types in ASP/ASP.NET? Different Authentication modes?

2. How .Net has implemented security for web applications?

3. How to do Forms authentication in asp.net?

4. Explain authentication levels in .net ?

5. Explain autherization levels in .net ?

6. What is Role-Based security?

Ans. A role is a named set of principals that have the same privileges with respect to security (such as a teller or a manager). A principal can be a member of one or more roles. Therefore, applications can use role membership to determine whether a principal is authorized to perform a requested action.

7. How will you do windows authentication and what is the namespace?

Ans. If a user is logged under integrated windows authentication mode, but he is still not able to logon, what might be the possible cause for this? In ASP.Net application how do you find the name of the logged in person under windows authentication?

8. What are the different authentication modes in the .NET environment?

Ans.
loginUrl="url"
protection="All|None|Encryption|Validation"
timeout="30" path="/" >
requireSSL="true|false"
slidingExpiration="true|false">







Attribute Option Description
mode Controls the default authentication mode for an application.
Windows Specifies Windows authentication as the default authentication mode. Use this mode when using any form of Microsoft Internet Information Services (IIS) authentication: Basic, Digest, Integrated Windows authentication (NTLM/Kerberos), or certificates.
Forms Specifies ASP.NET forms-based authentication as the default authentication mode.
Passport Specifies Microsoft Passport authentication as the default authentication mode.
None Specifies no authentication. Only anonymous users are expected or applications can handle events to provide their own authentication.

9. How do you specify whether your data should be passed as Query string and Forms (Mainly about POST and GET)

Ans. Through attribute tag of form tag.

10. What is the other method, other than GET and POST, in ASP.NET?

11. What are validator?

Ans. Name the Validation controls in asp.net? How do u disable them? Will the asp.net validators run in server side or client side? How do you do Client-side validation in .Net? How to disable validator control by client side JavaScript?
A set of server controls included with ASP.NET that test user input in HTML and Web server controls for programmer-defined requirements. Validation controls perform input checking in server code. If the user is working with a browser that supports DHTML, the validation controls can also perform validation ("EnableClientScript" property set to true/false) using client script.
The following validation controls are available in asp.net:
RequiredFieldValidator Control, CompareValidator Control, RangeValidator Control, RegularExpressionValidator Control, CustomValidator Control, ValidationSummary Control.

12. Which two properties are there on every validation control?

Ans. ControlToValidate, ErrorMessage

13. How do you use css in asp.net?

Ans. Within the head section of an HTML document that will use these styles, add a link to this external CSS style sheet that
follows this form:

15. How do you implement postback with a text box? What is postback and usestate?

Ans. Make AutoPostBack property to true

16. How can you debug an ASP page, without touching the code?

17. What is SQL injection?

Ans. An SQL injection attack "injects" or manipulates SQL code by adding unexpected SQL to a query.
Many web pages take parameters from web user, and make SQL query to the database. Take for instance when a user login, web page that user name and password and make SQL query to the database to check if a user has valid name and password.
Username: ' or 1=1 ---
Password: [Empty]
This would execute the following query against the users table:
select count(*) from users where userName='' or 1=1 --' and userPass=''

SQL Server Stored Procedures

1. What is Stored procedure?
A stored procedure is a set of Structured Query Language (SQL) statements that you assign a name to and store in a database in compiled form so that you can share it between a number of programs.
o They allow modular programming.
o They allow faster execution.
o They can reduce network traffic.
o They can be used as a security mechanism.
2. What are the different types of Storage Procedure?
a. Temporary Stored Procedures - SQL Server supports two types of temporary procedures: local and global. A local temporary procedure is visible only to the connection that created it. A global temporary procedure is available to all connections. Local temporary procedures are automatically dropped at the end of the current session. Global temporary procedures are dropped at the end of the last session using the procedure. Usually, this is when the session that created the procedure ends. Temporary procedures named with # and ## can be created by any user.
b. System stored procedures are created and stored in the master database and have the sp_ prefix.(or xp_) System stored procedures can be executed from any database without having to qualify the stored procedure name fully using the database name master. (If any user-created stored procedure has the same name as a system stored procedure, the user-created stored procedure will never be executed.)
c. Automatically Executing Stored Procedures - One or more stored procedures can execute automatically when SQL Server starts. The stored procedures must be created by the system administrator and executed under the sysadmin fixed server role as a background process. The procedure(s) cannot have any input parameters.
d. User stored procedure
3. How do I mark the stored procedure to automatic execution?
You can use the sp_procoption system stored procedure to mark the stored procedure to automatic execution when the SQL Server will start. Only objects in the master database owned by dbo can have the startup setting changed and this option is restricted to objects that have no parameters.
USE master
EXEC sp_procoption 'indRebuild', 'startup', 'true')
4. How can you optimize a stored procedure?
5. How will know whether the SQL statements are executed?
When used in a stored procedure, the RETURN statement can specify an integer value to return to the calling application, batch, or procedure. If no value is specified on RETURN, a stored procedure returns the value 0. The stored procedures return a value of 0 when no errors were encountered. Any nonzero value indicates an error occurred.
6. Why one should not prefix user stored procedures with sp_?
It is strongly recommended that you do not create any stored procedures using sp_ as a prefix. SQL Server always looks for a stored procedure beginning with sp_ in this order:
0. The stored procedure in the master database.
1. The stored procedure based on any qualifiers provided (database name or owner).
2. The stored procedure using dbo as the owner, if one is not specified.
Therefore, although the user-created stored procedure prefixed with sp_ may exist in the current database, the master database is always checked first, even if the stored procedure is qualified with the database name.
7. What can cause a Stored procedure execution plan to become invalidated and/or fall out of cache?
0. Server restart
1. Plan is aged out due to low use
2. DBCC FREEPROCCACHE (sometime desired to force it)
8. When do one need to recompile stored procedure?
if a new index is added from which the stored procedure might benefit, optimization does not automatically happen (until the next time the stored procedure is run after SQL Server is restarted).
9. SQL Server provides three ways to recompile a stored procedure:
• The sp_recompile system stored procedure forces a recompile of a stored procedure the next time it is run.
• Creating a stored procedure that specifies the WITH RECOMPILE option in its definition indicates that SQL Server does not cache a plan for this stored procedure; the stored procedure is recompiled each time it is executed. Use the WITH RECOMPILE option when stored procedures take parameters whose values differ widely between executions of the stored procedure, resulting in different execution plans to be created each time. Use of this option is uncommon, and causes the stored procedure to execute more slowly because the stored procedure must be recompiled each time it is executed.
• You can force the stored procedure to be recompiled by specifying the WITH RECOMPILE option when you execute the stored procedure. Use this option only if the parameter you are supplying is atypical or if the data has significantly changed since the stored procedure was created.
10. How to find out which stored procedure is recompiling? How to stop stored procedures from recompiling?
11. I have Two Stored Procedures SP1 and SP2 as given below. How the Transaction works, whether SP2 Transaction succeeds or fails?
CREATE PROCEDURE SP1 AS
BEGIN TRAN
INSERT INTO MARKS (SID,MARK,CID) VALUES (5,6,3)
EXEC SP2
ROLLBACK
GO

CREATE PROCEDURE SP2 AS
BEGIN TRAN
INSERT INTO MARKS (SID,MARK,CID) VALUES (100,100,103)
commit tran
GO
Both will get roll backed.
12. CREATE PROCEDURE SP1 AS
BEGIN TRAN
INSERT INTO MARKS (SID,MARK,CID) VALUES (5,6,3)
BEGIN TRAN
INSERT INTO STUDENT (SID,NAME1) VALUES (1,'SA')
commit tran
ROLLBACK TRAN
GO
Both will get roll backed.
13. How will you handle Errors in Sql Stored Procedure?
INSERT NonFatal VALUES (@Column2)
IF @@ERROR <>0
BEGIN
PRINT 'Error Occured'
END
http://www.sqlteam.com/item.asp?ItemID=2463
14. How will you raise an error in sql?
RAISERROR - Returns a user-defined error message and sets a system flag to record that an error has occurred. Using RAISERROR, the client can either retrieve an entry from the sysmessages table or build a message dynamically with user-specified severity and state information. After the message is defined it is sent back to the client as a server error message.
15. I have a stored procedure like
commit tran
create table a()
insert into table b
--
--
rollback tran
what will be the result? Is table created? data will be inserted in table b?
16. What do you do when one procedure is blocking the other?
**
17. How you will return XML from Stored Procedure?
You use the FOR XML clause of the SELECT statement, and within the FOR XML clause you specify an XML mode: RAW, AUTO, or EXPLICIT.
18. What are the differences between RAW, AUTO and Explicit modes in retrieving data from SQL Server in XML format?
**
19. Can a Stored Procedure call itself (recursive). If so then up to what level and can it be control?
Stored procedures are nested when one stored procedure calls another. You can nest stored procedures up to 32 levels. The nesting level increases by one when the called stored procedure begins execution and decreases by one when the called stored procedure completes execution. Attempting to exceed the maximum of 32 levels of nesting causes the whole calling stored procedure chain to fail. The current nesting level for the stored procedures in execution is stored in the @@NESTLEVEL function.
eg:
SET NOCOUNT ON
USE master
IF OBJECT_ID('dbo.sp_calcfactorial') IS NOT NULL
DROP PROC dbo.sp_calcfactorial
GO
CREATE PROC dbo.sp_calcfactorial
@base_number int, @factorial int OUT
AS
DECLARE @previous_number int
IF (@base_number<2) factorial="1" 1="1
ELSE BEGIN
SET @previous_number=@base_number-1
EXEC dbo.sp_calcfactorial @previous_number, @factorial OUT -- Recursive call
IF (@factorial=-1) RETURN(-1) -- Got an error, return
SET @factorial=@factorial*@base_number
END
RETURN(0)
GO

calling proc.
DECLARE @factorial int
EXEC dbo.sp_calcfactorial 4, @factorial OUT
SELECT @factorial
20. Nested Triggers
Triggers are nested when a trigger performs an action that initiates another trigger, which can initiate another trigger, and so on. Triggers can be nested up to 32 levels, and you can control whether triggers can be nested through the nested triggers server configuration option.
21. What is an extended stored procedure? Can you instantiate a COM object by using T-SQL?
An extended stored procedure is a function within a DLL (written in a programming language like C, C++ using Open Data Services (ODS) API) that can be called from T-SQL, just the way we call normal stored procedures using the EXEC statement.
22. Difference between view and stored procedure?
Views can have only select statements (create, update, truncate, delete statements are not allowed) Views cannot have “select into”, “Group by” “Having”, ”Order by”
23. What is a Function & what are the different user defined functions?
Function is a saved Transact-SQL routine that returns a value. User-defined functions cannot be used to perform a set of actions that modify the global database state. User-defined functions, like system functions, can be invoked from a query. They also can be executed through an EXECUTE statement like stored procedures.
0. Scalar Functions
Functions are scalar-valued if the RETURNS clause specified one of the scalar data types
1. Inline Table-valued Functions
If the RETURNS clause specifies TABLE with no accompanying column list, the function is an inline function.
2. Multi-statement Table-valued Functions
If the RETURNS clause specifies a TABLE type with columns and their data types, the function is a multi-statement table-valued function.
24. What are the difference between a function and a stored procedure?

0. Functions can be used in a select statement where as procedures cannot
1. Procedure takes both input and output parameters but Functions takes only input parameters
2. Functions cannot return values of type text, ntext, image & timestamps where as procedures can
3. Functions can be used as user defined datatypes in create table but procedures cannot
***Eg:-create table (name varchar(10),salary getsal(name))
Here getsal is a user defined function which returns a salary type, when table is created no storage is allotted for salary type, and getsal function is also not executed, But when we are fetching some values from this table, getsal function get’s executed and the return
Type is returned as the result set.
How to debug a stored procedure?

Dot Net Interview Questions - Part 9

1. How do you implement postback with a text box? What is postback and usestate?
   Make AutoPostBack property to true
2. How can you debug an ASP page, without touching the code?
3. What is SQL injection?
   An SQL injection attack "injects" or manipulates SQL code by adding unexpected SQL to a query.
   Many web pages take parameters from web user, and make SQL query to the database. Take for instance when a user login, web page that user name and password and make SQL query to the database to check if a user has valid name and password.
   Username: ' or 1=1 ---
   Password: [Empty]
   This would execute the following query against the users table:
   select count(*) from users where userName='' or 1=1 --' and userPass=''
4. How can u handle Exceptions in Asp.Net?
5. How can u handle Un Managed Code Exceptions in ASP.Net?
6. Asp.net - How to find last error which occurred?
   A: Server.GetLastError();
   [C#]
   Exception LastError;
   String ErrMessage;
   LastError = Server.GetLastError();
   if (LastError != null)
   ErrMessage = LastError.Message;
   else
   ErrMessage = "No Errors";
   Response.Write("Last Error = " + ErrMessage);

7. How to do Caching in ASP?
A: <%@ OutputCache Duration="60" VaryByParam="None" %>

VaryByParam value	Description
none	One version of page cached (only raw GET)
*	n versions of page cached based on query string and/or POST body
v1	n versions of page cached based on value of v1 variable in query string or POST body
v1;v2	n versions of page cached based on value of v1 and v2 variables in query string or POST body

<%@ OutputCache Duration="60" VaryByParam="none" %>
<%@ OutputCache Duration="60" VaryByParam="*" %>
<%@ OutputCache Duration="60" VaryByParam="name;age" %>
The OutputCache directive supports several other cache varying options

• VaryByHeader - maintain separate cache entry for header string changes (UserAgent, UserLanguage, etc.)
• VaryByControl - for user controls, maintain separate cache entry for properties of a user control
• VaryByCustom - can specify separate cache entries for browser types and version or provide a custom GetVaryByCustomString method in HttpApplicationderived class
7. What is the Global ASA(X) File?

9. Any alternative to avoid name collisions other then Namespaces.
   A scenario that two namespaces named N1 and N2 are there both having the same class say A. now in another class i ve written
   using N1;using N2;
   and i am instantiating class A in this class. Then how will u avoid name collisions?
   Ans: using alias
   Eg: using MyAlias = MyCompany.Proj.Nested;
10. Which is the namespace used to write error message in event Log File?
11. What are the page level transaction and class level transaction?
12. What are different transaction options?
13. What is the namespace for encryption?
14. What is the difference between application and cache variables?
15. What is the difference between control and component?
16. You ve defined one page_load event in aspx page and same page_load event in code behind how will prog run?
17. Where would you use an IHttpModule, and what are the limitations of any approach you might take in implementing one?
18. Can you edit data in the Repeater control? Which template must you provide, in order to display data in a Repeater control? How can you provide an alternating color scheme in a Repeater control? What property must you set, and what method must you call in your code, in order to bind the data from some data source to the Repeater control?
19. What is the use of web.config? Difference between machine.config and Web.config?
    ASP.NET configuration files are XML-based text files--each named web.config--that can appear in any directory on an ASP.NET Web application server. Each web.config file applies configuration settings to the directory it is located in and to all virtual child directories beneath it. Settings in child directories can optionally override or modify settings specified in parent directories. The root configuration file--WinNT\Microsoft.NET\Framework\\config\machine.config—provides default configuration settings for the entire machine. ASP.NET configures IIS to prevent direct browser access to web.config
    files to ensure that their values cannot become public (attempts to access them will cause ASP.NET to return 403: Access Forbidden).
    At run time ASP.NET uses these web.config configuration files to hierarchically compute a unique collection of settings for each incoming URL target request (these settings are calculated only once and then cached across subsequent requests; ASP.NET automatically watches for file changes and will invalidate the cache if any of the configuration files change).

What is the use of sessionstate tag in the web.config file?
Configuring session state: Session state features can be configured via the section in a web.config file. To double the default timeout of 20 minutes, you can add the following to the web.config file of an application: