MCSD.NET - 70-340 Exam Interview Question:

Suppose You create a Web Forms application to track
employee expense report information. Information is entered by each user and stored in a
Microsoft SQL Server database. The application uses Integrated Windows authentication with
impersonation enabled to communicate with the database. All users are assigned to the
DataReader role and the DataWriter role in SQL Server.
The employee expense report form contains client-side validation scripts and additional server
controls. This form is ViewState enabled. All employee expense reports must be approved by the
accounting department by using a separate form in the application before payment is made.
You need to unit exam the security of the application.
What should you do?
A. Copy the ViewState information to a text file and attempt to decrypt it.
B. Exam the application from the hosting computer and from the client computers.
C. Create your own page that mimics the approved page and submit that page to the server.
D. Sign on as a user in the accounting department and verify that you can approve expense
reports.