asp.net interview questions part 6

ASP.NET Interview Questions on Tracing

What is an exception log? 
An exception log is a list of handled exceptions that occur while your application is running. Reviewing the exception log periodically helps you verify that exceptions are being handled correctly, are not occurring too frequently, and are not preventing users from accomplishing tasks with your application.

What is Tracing and what are the adavantages of using tracing to log exceptions?

Tracing is a technique for recording events, such as exceptions, in an application. There have always been ways to record errors in an application - usually by opening a file and writing error messages to it. But tracing offers the following significant advantages:
Standardization:Building tracing into the .NET Framework ensures that programming techniques are the same across all the applications you develop with the .NET Framework.
Built-in Web support:ASP.NET extends the .NET Framework tools by including information related to the performance and behavior of Web requests.
Configuration:You can turn tracing on and off using settings in your application’s configuration file. You don’t have to recompile your application to enable or disable tracing.
Performance:While disabled, tracing statements do not affect application performance.

How do you turn tracing on and off for an ASP.NET web application? 
Tracing can be turned on or off for an entire Web application or for an individual page in the application:
1. To turn tracing on for an entire application, in the application’s Web.config file, set the trace element’s Enabled attribute to True.
Or
2. To turn tracing on for a single page, set the DOCUMENT object’s Trace property to True in the Visual Studio .NET Properties window. This sets the @ Page directive’s Trace attribute to True in the Web form’s HTML.

Where is the trace output displayed by default?
By default, trace output is displayed at the end of each Web page.

While this is fine for debugging purposes, you’ll generally want to write trace output to a log file when you start testing your completed application. To write trace messages to a log file for an entire application, in the application’s Web.config file, set the trace element’s PageOutput attribute to False. ASP.NET then writes trace output to the Trace.axd file in your application’s root folder.

How do you specify, how many page requets should be written to the trace log? 

The <trace> element's RequestLimit attribute can be used to specify how many page requests to write to the trace log. For example, the following line from a Web.config file turns on tracing for the application and writes the first 10 requests to the Trace.axd file:

How do you write trace messages to a log file for only selected pages in an application?To write trace messages to a log file for only selected pages in an application, follow these steps:
In the application’s Web.config file, set the trace element’s Enabled attribute to True and PageOutput attribute to False.
For each Web page you want to exclude from tracing, set the @ Page directive’s Trace attribute to False.

What is the difference between Trace.Write() and Trace.Warn() methods of a trace object? 
The Trace object provides the Write and Warn methods to allow you to write messages to a request’s trace information. The two methods are identical with one difference: messages written with Trace.Write are displayed in black, whereas messages written with Trace.Warn are displayed in red.
How do you programatically check if tracing is enabled?
The Trace object’s IsEnabled property can be used to programatically check if tracing is enabled.

How do you prevent from trace output being written at the bottom of the web page? 
You can prevent from trace output being written at the bottom of the web page by setting the trace element’s PageOutput attribute to False in the Web.config file.

What is the name of the file to which trace log is written?
Trace.axd

Can you view Trace.axd from a remote machine?
No, by default, you can view Trace.axd only from the local server running the application. If you want to view the trace log from a remote machine, set the trace element’s LocalOnly attribute to False in the Web.config file

Techniques to send data from one web form to another web form

What are the different techniques to send data from one web form to another web form? 1. Query strings :Use these strings to pass information between requests and responses as part of the Web address. Query strings are visible to the user, so they should not contain secure information such as passwords.

2. Cookies :
Use cookies to store small amounts of information on a client. Clients might refuse cookies, so your code has to anticipate that possibility.

3. Session state :
Use Session state variables to store items that you want keep local to the current session (single user).

4. Application state :
Use Application state variables to store items that you want be available to all users of the application.

ASP.NET Session State and Application State Interview Questions

What is a Session?
A Session is a unique instance of the browser. A single user can have multiple instances of the browser running on his or her machine. If each instance visits your Web application, each instance has a unique session.A session starts when a user accesses a page on a Web site for the first time, at which time they are assigned a unique session ID. The server stores the user's session ID in the Session.SessionID property.

What is the default session timeout period? 
20 minutes.

Where do you generally specify the Session Timeout?
You specify the Session Timeout setting in the web.config file.

Can you specify Session Timeout in a code behind file? 
Yes, can specify the Session.Timeout property as shown below in a code behind file.
Session.Timeout = 10;

How do you end a user session?
You can call the Session.Abandon() method to end a user session. If a user then tries to access a page the server will assign them a new session ID and it will clear all the previous session variables. You'll typically use Session.Abandon() on log-out pages.

What type of data can you store in Application State and Session State variables? 
Application State and Session State variables are used to store data that you want to keep for the lifetime of an application or for the lifetime of a session. You can store any type of data in the Application or Session state, including objects.

Are Application State or Session State variables type safe?
No, Application and Session state variables are created on the fly, without variable name or type checking.

Do maintaining Session state affects performance? 
Yes

Can you turn of Session state?
Yes, Session state can be turned off at the application and page levels.

Are Application state variables available throughout the current process? 
Yes, Application state variables are available throughout the current process, but not across processes. If an application is scaled to run on multiple servers or on multiple processors within a server, each process has its own Application state.

How do you disable Session state for a Web form?
To turn Session state off for a Web form set EnableSessionState property of the Page to False.

How do you turn Session state off for an entire web application? 
In the Web.config file, set the sessionstate tag to False.

What are Application State variables? 
Application State variables are global variables that are available from anywhere in the application. All Sessions can access Application State variables.

How to add and remove data to Application State Variables? 
//Code to add data to Application StateApplication.Add("AppName", "Sample");
//Code to remove data from Application State
Application.Remove("AppName"); 

How do you remove all Application State Variables data? 
//Code to remove all Application State Variables data
Application.RemoveAll();

ASP.NET Interview Questions on web application Security

What is the difference between Authentication and Authorization? 
Authentication is the process of identifying users. Authorization is the process of granting access to those users based on identity. Together, authentication and authorization provide the means to keeping your Web application secure from intruders.

What is Anonymous access?
Anonymous access is the way most public Web sites work. Sites containing public information allow anyone to see that information, so they don’t authenticate users. ASP.NET Web applications provide anonymous access to resources on the server by impersonation. Impersonation is the process of assigning a user account to an unknown user.

What is the account that is associated with Anonymous access? 
By default, the anonymous access account is named IUSER_machinename. You use that account to control anonymous users’ access to resources on the server.
What is the default user account under which an ASP.NET web application run on a web server?
Under the default settings, ASP.NET uses the ASPNET account to run the Web application. This means that if the application attempts to perform any tasks that are not included in the ASPNET account’s privileges, a security exception will occur and access will be denied.

How do you restrict the access of anonymous users? 
You restrict the access of anonymous users by setting Windows file permissions. To be secure, your server must use the Microsoft Windows NT file system (NTFS). The earlier FAT or FAT32 file systems do not provide file-level security.
What are the 3 major ways to authenticate and authorize users within an ASP.NET Web application?
Windows authentication : Identifies and authorizes users based on the server’s user list. Access to resources on the server is then granted or denied based on the user account’s privileges. This works the same way as regular Windows network security.
Forms authentication : Directs users to a logon Web form that collects user name and password information, and then authenticates the user against a user list or database that the application maintains.
Passport authentication : Directs new users to a site hosted by Microsoft so that they can register a single user name and password that will authorize their access to multiple Web sites. Existing users are prompted for their Microsoft Passport user name and password, which the application then authenticates from the Passport user list.

What is the namespace where all security related classes are present? 
System.Web.Security

What type of authentication can be used for Public Internet Web application?
Anonymous access. This is the common access method for most Web sites. No logon is required, and you secure restricted resources using NTFS file permissions.

What type of authentication can be used for Intranet Web application? 
Windows authentication. Windows authentication authenticates network users through the domain controller. Network users have access to Web application resources as determined by their user privileges on the server.
What type of authentication can be used for Private corporate Web application?
Windows authentication. Corporate users can access the Web application using their corporate network user names and passwords. User accounts are administered using the Windows network security tools.

What type of authentication can be used for Commercial Web application? 
Forms authentication. Applications that need to collect shipping and billing information should implement Forms authentication to gather and store customer information.

What type of authentication can be used for Multiple commercial Web applications?Passport authentication. Passport authentication allows users to sign in once through a central authority. The user’s identity is then available to any application using the Passport SDK. Customer information is maintained in a Passport profile, rather than in a local database.

Can you use ASP.NET Authentication with HTM and HTML Files? 
The three ASP.NET authentication modes apply to files that are part of the Web application. That includes Web forms (.aspx), modules (.asax), and other resources that are processed through the Web application’s executable. It does not automatically include HTML pages (.htm or .html). Those pages are handled by Internet Information Services (IIS), rather than ASP.NET. If you want to authenticate users who access HTML pages from within your Web application using Windows, Forms, or Passport authentication modes, you must map those files to the ASP.NET executable.

How do map .htm and .html files to the ASP.NET executable using the IIS snap-in? 
To map .htm and .html files to the ASP.NET executable using the IIS snap-in, follow these steps:
1. In the IIS snap-in, select the folder containing your Web application, and then choose Properties from the Action menu. IIS displays the Properties dialog box.
2. Click the Home Directory or Virtual Directory tab, and then click Configuration. IIS displays the Application Configuration dialog box, as shown in the diagram below.
3. Click Add. IIS displays the Add/Edit Application Extension Mapping dialog box, as shown in the diagram below.
4. Click Browse, and select the aspnet_isapi.dll file. That file is stored in the Windows Microsoft .NET Framework directory; the path will be something like C:\Windows\Microsoft.NET\Framework\versionnumber\aspnet_isapi.dll.
5. Type .htm in the File Extension box, and click OK.
6. Repeat steps 3 through 5 for the .html file extension. Click OK to close the IIS dialog boxes when you’ve finished.

what is advantage of asp.net?

ASP.NET is a very valuable tool for programmers and developers as it allows them to build dynamic, rich web sites and web applications.