Cis 407 Asp.net Chapter 18,

Front 1

How do you prevent other from reading data that is transmitted over the internet

Back 1

Using SSL secure sockets Layer

Front 2

How do you determine if you are transmitting data over a secure connection.

Back 2

Lock

Front 3

What is the process that SSL uses? How does it encrypt and decrypt data.

Back 3

With SSL, the browser encrypts all data that’s sent to the server and decrypts all data that’s received from the server. Conversely, the server encrypts all data that’s sent to the browser and decrypts all data that’s received from the browser.

Front 4

Is SSL able to determine is data was tampered with during transit?

Back 4

Yes.

Front 5

What does the URL start with with secure connection.

Back 5

The URL for a secure connection starts with HTTPS instead of HTTP.

Front 6

How do you test an application that uses SSL

Back 6

To test an application that uses SSL, you must run the application under IIS or IIS Express.

Front 7

What else is in the web browser to show that there is a secure connection

Back 7

A lock

Front 8

What is assigned when an application under ISS Express is running on the local server?

Back 8

When you create an application that runs under IIS Express, it’s assigned a port number on the local server.

Front 9

Where can you see this port number when you run the application?

Back 9

You can see this port number in the address bar after the localhost keyword when you run the application.

Front 10

What must you create to use SSL with an application.

Back 10

To use SSL with an application that runs under IIS Express, you need to create a binding for the HTTPS protocol for the application.

Front 11

How do you create the binding for the HTTPS protocol

Back 11

To do that, you simply set the SSL Enabled property of the project to True.

Front 12

When you use SSL , what is used to authenticate IIS Express

Back 12

When you use SSL with IIS Express, a test certificate is used to authenti- cate IIS Express. This certificate is installed along with Visual Studio and IIS Express. When y

Front 13

What is needed when you deploy and application to a production server?

Back 13

When you deploy an application to a production server, though, you’ll need to use a digital secure certificate.

Front 14

What is the purpose of digital certificates

Back 14

Digital secure certificates serve two purposes. First, they establish the identity of the server or client. Second, they provide the information needed to encrypt data before it’s transmitted.

Front 15

What happens if a browser doesn't recognize a certificate.

Back 15

If a browser doesn’t recognize a certificate as coming from a trusted source, however, it informs the user and lets the user view the certificate.

Front 16

What is SSL client authentication. Provide an example.

Back 16

A bank might want to use SSL client authentica- tion to make sure it’s sending sensitive information such as account numbers and balances to the correct person.

Front 17

How is SSL client authentication

Back 17

To implement this type of authentication, a digital secure certificate must be installed on the client..

Front 18

What must you obtain to use a SSL secure client connections.

Back 18

If you want to develop an ASP.NET application that uses SSL to secure client connections, you must first obtain a digital secure certificate from a trusted source such as those listed in this figure.

Front 19

Again, what are the two types of digital certificate.

Back 19

Front 20

What is SSL strength. What does a longer key mean.

Back 20

SSL strength refers to the length of the generated key that is created during the encryption process. The longer the key, the more difficult it is to break the encryp- tion code

Front 21

SSL strength depends on what three factors?

Back 21

1. Strength of certificate.
2. Strength of Client Browser
3. Strength of Server

Front 22

How do you request and install certificates.

Back 22

You can use the IIS Management Console to request and install certificates. To display this console, click the System and Security link in the Control Panel, followed by the Administrative Tools link. Then, double-click on Internet Information Services (IIS) Manage

Front 23

How do you request a connection for an ASP.net application

Back 23

To do that, you execute a Response.Redirect method with the URL for the HTTPS protocol

Front 24

What type of URL must you use for HTTPS?

Back 24

To request a secure connection using HTTPS, you must use an absolute URL. If you’re using IIS Express, that means that the URL must include the domain name and the port number for the HTTPS binding.

Front 25

What must the URL include (IIS Express)

Back 25

If you’re using IIS Express, that means that the URL must include the domain name and the port number for the HTTPS binding.

Front 26

Rather than coding the domain name and port number into each URL, you may want to store this information in the

Back 26

web.config file

Front 27

A web.config file that defines secure and unsecure path settings

Back 27

<?xml version= "1.0"?>

<configuration>

<appSettings>

<add key ="SecureAppPath" value="//localhost:44300/" />

add key ="UnsecureAppPath" value="//localhost:49565/">

</appSettings>

Front 28

Code that retrieves the secure application path from the web.config file

Back 28

string url = "https:" + ConfigurationManager.AppSettings["SecureAppPath"] + "CheckOut1.aspx"; Response.Redirect(url);

Front 29

Code that returns to an unsecured connection

Back 29

string url = "http:" + ConfigurationManager.AppSettings["UnSecureAppPath"] + "Order.aspx"; Response.Redirect(url);

Front 30

How do you request a secure connection

Back 30

To request a secure connection, you must use an absolute URL that specifies HTTPS as the protocol. Once you establish a secure connection, you can use rela- tive URLs to continue using the secure connection

Front 31

How do you return an unsecured connection

Back 31

To return to an unsecured connection after using a secure connection, you must code an absolute URL that specifies the HTTP protocol.

Front 32

Instead of coding the application’s path into each URL, what can you do

Back 32

You can store secure and unsecure paths in the appSettings section of the web.config file.

Front 33

What property must you used of the ConfigurationManager class withing the application to acces the elements of the appSettings section of the web.config file

Back 33

AppSettings property

Front 34

What is displayed in a browser before a secure connection is established or closed.

Back 34

Depending on the security settings in your browser, a dialog box may be displayed before a secure connection is established or before a secure connection is closed.

Front 35

How do I make sure the page is operating on a secure connection

Back 35

check the IsSecureConnection property of the HttpRequest object in its Load event handler.

Front 36

If the page is not using a secure connection what should it do.

Back 36

If the page isn’t using a secure connection, it should switch to a secure connection to protect the privacy of the user’s data. To do that, it can replace the unsecure application path with a secure application path.

Front 37

What are the properties of the HttpRequest

Back 37

1. IsSecureConnection- Returns true if the current connection is secure. Otherwise it returns False

2. Url - The URL of the current request.

Front 38

A Page_Load method that forces the page to use a secure connection

Back 38

Front 39

If your application is using a server other than IIS Express, you can switch to a secure connection by?

Back 39

If your application is using a server other than IIS Express, you can switch to a secure connection by replacing the HTTP protocol in the URL to HTTPS and then redirecting the browser to the new URL.