70-340 Implementing Security for Applications with Microsoft Visual C# .NET Brain Dump

Demo Question 5.

You are an application developer for EliteCertify.com. You are conducting a code review of an application that was developed by another developer. The code declares a variable named permvalue and a variable named grouplist. A portion of the application code defines security permissions for the user. The application is designed so that permvalue contains an integer that indicates various permissions within the application, and grouplist contains the name of a user group. The permvalue variable also contains values that indicate other information about the user. The grouplist and permvalue variables are initially populated by other components, which are called by the main application. The application contains the following code segment. (Line numbers are included for reference only.) 01 switch(grouplist) [ 02 case "Admin"; 03 case "Administrator": 04 permvalue = permvalue 256 ; 05 break; 06 case "Reviewer": 07 permvalue = permvalue 138 ; 08 break; 09 case "Manager": 10 permvalue = permvalue 64 ; 11 break; 12 } The design document for the application states that permvalue must have a value of zero when the user has no permissions. The design document also states that users not belonging to one of the four predefined groups must have no permissions. You need to ensure that the code segment assigns the correct value to premvalue in all circumstances. What should you do?

A. Add the following code before line 01 of the code segment. if(permvalue == 0) { throw new ApplicationException ( ) ; }
B. Add the following code before line 01 of the code segment. permvalue = 0 ;
C. Add the following code between lines 01 and 02 of the code segment. case "": permvalue = 0 ; Break ;
D. Add the following code between lines 11 and 12 of the code segment. default: permvalue = 0 ;


Display Answer

Answer: D

Explanation: Since the string variable and the integer variable can contain values populated from other components, when the 'Select Case' is reached their contents will have those values as the default. Assigning '0' to the permissions at the beginning of the 'Select Case' would mean the value of the permission would always be zero before reaching the Select Case statements. Assigning '0' as the last case would catch all that are not part of the Select Case specification.