# Keamanan & Best Practices (.NET) > OWASP Top 10, SQL injection, XSS, CSRF, encryption, Data Protection API, rate limiting, User Secrets, Azure Key Vault - 24 pertanyaan wawancara - Senior - [Pertanyaan Wawancara: .NET](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara.md) ## 1. Apa itu SQL injection dan bagaimana kerentanan ini memengaruhi keamanan aplikasi web? **Jawaban** SQL injection adalah serangan di mana kode SQL berbahaya disisipkan ke dalam input aplikasi untuk memanipulasi kueri basis data. Serangan ini memungkinkan akses, modifikasi, atau penghapusan data tanpa izin. Di ASP.NET Core, menggunakan kueri berparameter atau Entity Framework melindungi dari ancaman kritis OWASP Top 10 ini. ## 2. Apa itu Cross-Site Scripting (XSS) dan apa saja jenis utamanya? **Jawaban** XSS adalah kerentanan yang memungkinkan penyerang menyuntikkan kode JavaScript berbahaya ke dalam halaman web. Tiga jenis utamanya adalah: stored XSS (data persisten), reflected XSS (data sementara), dan DOM-based XSS (manipulasi sisi klien). Di ASP.NET Core, mengenkode output dan menggunakan Content Security Policy mencegah serangan ini. ## 3. Apa itu serangan CSRF (Cross-Site Request Forgery) dan bagaimana cara mencegahnya di ASP.NET Core? **Jawaban** CSRF adalah serangan di mana pengguna yang terautentikasi ditipu untuk melakukan tindakan yang tidak diinginkan di sebuah situs web. Penyerang memaksa browser mengirim permintaan terautentikasi ke situs target. ASP.NET Core mencegah CSRF dengan token anti-forgery (AntiForgeryToken), dengan memvalidasi header origin dan Referer, serta menggunakan cookies SameSite. ## 21 pertanyaan lagi tersedia - Apa tiga kontrol keamanan utama dalam OWASP Top 10? - Apa perbedaan antara autentikasi dan otorisasi di .NET? Daftar gratis: https://sharpskill.dev/id/login ## Topik wawancara .NET lainnya - [Dasar-Dasar C#](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/csharp-basics.md): 25 pertanyaan, Junior - [LINQ & Delegates](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/csharp-linq-delegates.md): 20 pertanyaan, Junior - [Esensi Bahasa C#](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/csharp-language-essentials.md): 15 pertanyaan, Junior - [Dasar-Dasar ASP.NET Core](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/aspnet-core-fundamentals.md): 18 pertanyaan, Junior - [Siklus Hidup Request ASP.NET Core](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/aspnet-core-request-lifecycle.md): 20 pertanyaan, Junior - [Configuration & Settings](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/configuration-settings.md): 20 pertanyaan, Junior - [Siklus Hidup Aplikasi](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/application-lifecycle.md): 20 pertanyaan, Junior - [Dependency Injection](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/dependency-injection.md): 24 pertanyaan, Mid-Level - [Entity Framework Core](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/entity-framework-core.md): 25 pertanyaan, Mid-Level - [Minimal APIs](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/minimal-apis.md): 18 pertanyaan, Mid-Level - [Pengembangan Web API](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/web-api-development.md): 22 pertanyaan, Mid-Level - [Async di ASP.NET Core](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/async-aspnet-core.md): 20 pertanyaan, Mid-Level - [Authentication & Authorization](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/authentication-authorization.md): 18 pertanyaan, Mid-Level - [HttpClient & Networking](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/httpclient-networking.md): 20 pertanyaan, Mid-Level - [Serialisasi JSON](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/json-serialization.md): 20 pertanyaan, Mid-Level - [Entity Framework Core Tingkat Lanjut](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/ef-core-advanced.md): 25 pertanyaan, Mid-Level - [Fitur Lanjutan C#](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/csharp-advanced-features.md): 20 pertanyaan, Mid-Level - [Clean Architecture](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/clean-architecture.md): 20 pertanyaan, Mid-Level - [Logging, Monitoring & Observability](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/logging-monitoring.md): 22 pertanyaan, Mid-Level - [Unit Testing & xUnit](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/unit-testing-xunit.md): 20 pertanyaan, Mid-Level - [Pengujian Integrasi](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/integration-testing.md): 18 pertanyaan, Mid-Level - [Docker & Containerization](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/docker-containerization.md): 16 pertanyaan, Mid-Level - [Manajemen Paket NuGet](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/nuget-package-management.md): 16 pertanyaan, Mid-Level - [Memory Management & GC](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/memory-management-gc.md): 22 pertanyaan, Senior - [Pemrograman reaktif](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/reactive-programming.md): 24 pertanyaan, Senior - [Async/await & Pola](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/async-await-patterns.md): 26 pertanyaan, Senior - [.NET Design Patterns](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/dotnet-design-patterns.md): 24 pertanyaan, Senior - [Optimasi Performa](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/performance-optimization.md): 22 pertanyaan, Senior - [SignalR & Real-time](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/signalr-realtime.md): 22 pertanyaan, Senior - [Arsitektur Microservices](https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/microservices-architecture.md): 25 pertanyaan, Senior --- Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack. HTML version of this page: https://sharpskill.dev/id/technologies/dotnet/pertanyaan-wawancara/security-best-practices