| 1 | What is ASP.NET Core Identity, and what does it provide out of the box? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 2 | How do you implement role-based authorization using the [Authorize(Roles = "...")] attribute? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 3 | How do refresh tokens work alongside short-lived access tokens, and why is this pattern used? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 4 | What is the OAuth 2.0 Client Credentials flow, and when is it used instead of the Authorization Code flow? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 5 | What is the purpose of the 'scope' parameter in OAuth 2.0, and how does it implement the principle of least privilege? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 6 | What are JWT claims, and how do you add custom claims when issuing a token? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 7 | How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 8 | How do you implement policy-based authorization for more complex, custom access rules beyond simple roles? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 9 | How does token revocation work with stateless JWTs, given they can't simply be 'deleted' server-side once issued? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 10 | How do you integrate external identity providers (Google, Microsoft Entra ID, Facebook) using OAuth/OpenID Connect in ASP.NET Core? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 11 | How does token validation work under the hood when the JwtBearer middleware receives a request, and what checks does it perform? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 12 | What is the difference between authentication and authorization in ASP.NET Core? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Beginner |
| 13 | How does JWT (JSON Web Token) authentication work at a high level in ASP.NET Core? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 14 | What are the security risks of storing JWTs in browser localStorage versus HttpOnly cookies? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 15 | How does ASP.NET Core support multiple authentication schemes simultaneously (e.g., cookies for a web UI and JWT for an API in the same application)? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 16 | How do authentication and authorization work together in a .NET application, and how would you implement both role-based and policy-based access control? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 17 | Why does the order in which middleware is registered matter so much in ASP.NET Core? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Intermediate |
| 18 | How do you conditionally apply middleware only to certain requests using UseWhen or MapWhen? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Intermediate |
| 19 | How does dependency injection work in Blazor components, and what's the difference between @inject and constructor injection? .NET › Blazor (Server & WebAssembly) | .NET | Blazor (Server & WebAssembly) | Intermediate |
| 20 | What is the difference between absolute expiration and sliding expiration when configuring a cache entry? .NET › Caching (In-Memory, Distributed & Redis) | .NET | Caching (In-Memory, Distributed & Redis) | Intermediate |
| 21 | What are the risks of caching sensitive or user-specific data, and how do you avoid cache poisoning across users? .NET › Caching (In-Memory, Distributed & Redis) | .NET | Caching (In-Memory, Distributed & Redis) | Intermediate |
| 22 | How do you configure a CORS policy in ASP.NET Core to allow requests from specific origins? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 23 | What does AllowCredentials() do in a CORS policy, and why can't it be combined with a wildcard origin? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 24 | Why must UseCors be positioned after UseRouting but before UseAuthorization in the ASP.NET Core middleware pipeline? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 25 | What is the difference between CORS and CSRF (Cross-Site Request Forgery), and how does CORS relate to (but not fully prevent) CSRF? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 26 | How do you register a service using a factory delegate instead of a simple type mapping, when construction requires custom logic? .NET › Dependency Injection | .NET | Dependency Injection | Intermediate |
| 27 | Why is it recommended to run a containerized .NET application as a non-root user, and how do you configure this in a Dockerfile? .NET › Docker & Containerization | .NET | Docker & Containerization | Intermediate |
| 28 | What is middleware in ASP.NET Core, and how does the order in which it's registered affect request handling? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Intermediate |
| 29 | How does UseRouting and endpoint routing (via MapControllers, MapGet, etc.) fit into the middleware pipeline conceptually? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Advanced |
| 30 | What is the recommended standard order for common middleware in a typical ASP.NET Core Web API pipeline, and why? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Advanced |
| 31 | Why is it dangerous to capture and store an HttpContext reference in a singleton-scoped service, and what should you use instead? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Advanced |
| 32 | How do you apply different CORS policies to different endpoints or controllers within the same application? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 33 | What security risks does an overly permissive CORS policy (like AllowAnyOrigin with credentials attempted, or reflecting the Origin header) introduce? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 34 | How does CORS behave differently for requests made from a mobile app or server-to-server call compared to a browser-based web app? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 35 | What information should be excluded from error responses in production to avoid leaking sensitive implementation details? .NET › Global Exception Handling & Middleware | .NET | Global Exception Handling & Middleware | Advanced |
| 36 | How does gRPC support interceptors for cross-cutting concerns like authentication, logging, and retries, similar to middleware in a REST pipeline? .NET › gRPC Services | .NET | gRPC Services | Advanced |
| 37 | How do you handle authentication for gRPC calls, and how does it differ from typical REST API authentication patterns? .NET › gRPC Services | .NET | gRPC Services | Advanced |