# Security & Best Practices (.NET)

> OWASP Top 10, SQL injection, XSS, CSRF, encryption, Data Protection API, rate limiting, User Secrets, Azure Key Vault

- 24 interview questions
- Senior
- [Interview Questions: .NET](https://sharpskill.dev/en/technologies/dotnet/interview-questions.md)

## 1. What is SQL injection and how does this vulnerability affect web application security?

**Answer**

SQL injection is an attack where malicious SQL code is inserted into application inputs to manipulate database queries. It enables unauthorized access, modification, or deletion of data. In ASP.NET Core, using parameterized queries or Entity Framework protects against this critical OWASP Top 10 threat.

## 2. What is Cross-Site Scripting (XSS) and what are its main types?

**Answer**

XSS is a vulnerability allowing attackers to inject malicious JavaScript code into web pages. The three main types are: stored XSS (persistent data), reflected XSS (transient data), and DOM-based XSS (client-side manipulation). In ASP.NET Core, encoding output and using Content Security Policy prevent these attacks.

## 3. What is a CSRF (Cross-Site Request Forgery) attack and how to prevent it in ASP.NET Core?

**Answer**

CSRF is an attack where an authenticated user is tricked into performing unintended actions on a website. The attacker forces the browser to send authenticated requests to the target site. ASP.NET Core prevents CSRF with anti-forgery tokens (AntiForgeryToken), by validating origin and Referer headers, and using SameSite cookies.

## 21 more questions available

- What are the three main security controls in the OWASP Top 10?
- What is the difference between authentication and authorization in .NET?

Sign up for free: https://sharpskill.dev/en/login

## Other .NET interview topics

- [C# Basics](https://sharpskill.dev/en/technologies/dotnet/interview-questions/csharp-basics.md): 25 questions, Junior
- [LINQ & Delegates](https://sharpskill.dev/en/technologies/dotnet/interview-questions/csharp-linq-delegates.md): 20 questions, Junior
- [C# Language Essentials](https://sharpskill.dev/en/technologies/dotnet/interview-questions/csharp-language-essentials.md): 15 questions, Junior
- [ASP.NET Core Fundamentals](https://sharpskill.dev/en/technologies/dotnet/interview-questions/aspnet-core-fundamentals.md): 18 questions, Junior
- [ASP.NET Core Request Lifecycle](https://sharpskill.dev/en/technologies/dotnet/interview-questions/aspnet-core-request-lifecycle.md): 20 questions, Junior
- [Configuration & Settings](https://sharpskill.dev/en/technologies/dotnet/interview-questions/configuration-settings.md): 20 questions, Junior
- [Application Lifecycle](https://sharpskill.dev/en/technologies/dotnet/interview-questions/application-lifecycle.md): 20 questions, Junior
- [Dependency Injection](https://sharpskill.dev/en/technologies/dotnet/interview-questions/dependency-injection.md): 24 questions, Mid-Level
- [Entity Framework Core](https://sharpskill.dev/en/technologies/dotnet/interview-questions/entity-framework-core.md): 25 questions, Mid-Level
- [Minimal APIs](https://sharpskill.dev/en/technologies/dotnet/interview-questions/minimal-apis.md): 18 questions, Mid-Level
- [Web API Development](https://sharpskill.dev/en/technologies/dotnet/interview-questions/web-api-development.md): 22 questions, Mid-Level
- [Async in ASP.NET Core](https://sharpskill.dev/en/technologies/dotnet/interview-questions/async-aspnet-core.md): 20 questions, Mid-Level
- [Authentication & Authorization](https://sharpskill.dev/en/technologies/dotnet/interview-questions/authentication-authorization.md): 18 questions, Mid-Level
- [HttpClient & Networking](https://sharpskill.dev/en/technologies/dotnet/interview-questions/httpclient-networking.md): 20 questions, Mid-Level
- [JSON Serialization](https://sharpskill.dev/en/technologies/dotnet/interview-questions/json-serialization.md): 20 questions, Mid-Level
- [Entity Framework Core Advanced](https://sharpskill.dev/en/technologies/dotnet/interview-questions/ef-core-advanced.md): 25 questions, Mid-Level
- [C# Advanced Features](https://sharpskill.dev/en/technologies/dotnet/interview-questions/csharp-advanced-features.md): 20 questions, Mid-Level
- [Clean Architecture](https://sharpskill.dev/en/technologies/dotnet/interview-questions/clean-architecture.md): 20 questions, Mid-Level
- [Logging, Monitoring & Observability](https://sharpskill.dev/en/technologies/dotnet/interview-questions/logging-monitoring.md): 22 questions, Mid-Level
- [Unit Testing & xUnit](https://sharpskill.dev/en/technologies/dotnet/interview-questions/unit-testing-xunit.md): 20 questions, Mid-Level
- [Integration Testing](https://sharpskill.dev/en/technologies/dotnet/interview-questions/integration-testing.md): 18 questions, Mid-Level
- [Docker & Containerization](https://sharpskill.dev/en/technologies/dotnet/interview-questions/docker-containerization.md): 16 questions, Mid-Level
- [NuGet Package Management](https://sharpskill.dev/en/technologies/dotnet/interview-questions/nuget-package-management.md): 16 questions, Mid-Level
- [Memory Management & GC](https://sharpskill.dev/en/technologies/dotnet/interview-questions/memory-management-gc.md): 22 questions, Senior
- [Reactive Programming](https://sharpskill.dev/en/technologies/dotnet/interview-questions/reactive-programming.md): 24 questions, Senior
- [Async/await & Patterns](https://sharpskill.dev/en/technologies/dotnet/interview-questions/async-await-patterns.md): 26 questions, Senior
- [.NET Design Patterns](https://sharpskill.dev/en/technologies/dotnet/interview-questions/dotnet-design-patterns.md): 24 questions, Senior
- [Performance Optimization](https://sharpskill.dev/en/technologies/dotnet/interview-questions/performance-optimization.md): 22 questions, Senior
- [SignalR & Real-time](https://sharpskill.dev/en/technologies/dotnet/interview-questions/signalr-realtime.md): 22 questions, Senior
- [Microservices Architecture](https://sharpskill.dev/en/technologies/dotnet/interview-questions/microservices-architecture.md): 25 questions, Senior

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/en/technologies/dotnet/interview-questions/security-best-practices