Secrets, Config, and Security Headers

1. What is the primary rule regarding secrets in source control?

Secrets should be stored in the code repository. No secret is ever committed to source control. Secrets can be included if they are marked as confidential. It is acceptable to store secrets in configuration files.

2. What does HSTS stand for, and what is its purpose?

HTTP Strict Transport Security; to enforce secure connections to a server. Hypertext Transfer Security Standard; to validate content types. Hyper Secure Transport Socket; to encrypt all data at rest. HTTP Security Transport Standard; to protect against DDoS attacks.

3. Which response header is primarily used to prevent MIME-sniffing attacks?

X-Frame-Options X-Content-Type-Options Content-Security-Policy Strict-Transport-Security

4. What command can developers use to check for vulnerable dependencies in their application?

dotnet audit packages dotnet check vulnerabilities dotnet list package --vulnerable dotnet scan packages

Continue: Why and What to Test → Review this lesson Retake quiz