Exam Essentials

Be familiar with the types of authentication offered in .NET.  Know the characteristics of the most popular authentication methods. Know that Basic, Digest, and Integrated Windows Security are authentication methods supplied by IIS.

Know how to work with Permission and PermissionSet objects.  Know the three types of permissions (code access, identity, and role-based). Know how to demand permissions by using both declarative and imperative code. Know how and why to assert, deny, and permit only code access permissions. Know how to combine permissions with the Union and Intersect methods. Know how to use AddPermission, RemovePermission, and SetPermission methods to manipulate permission sets.

Understand and know how to work with the three code security models provided by .NET.  Know how CLR role-based security uses Identity and Principal objects to determine role membership, and how to check role membership via imperative Demand, imperative IsInRole, and declarative Demand. Know that code access security grants permissions by examining evidence and comparing that to the evidence indicated for security policies, and that the permissions granted to code are the most restrictive of those granted at all policy levels combined. Know that .NET Enterprise Services role-based security requires your class to inherit from the ServicedComponent class, how to use the IsSecurityEnabled property of the SecurityCallContextObject to verify that .NET Enterprise Services role-based security is enabled, and how to check role membership via IsCallerInRole or declaratively, via attributes.

Understand the basics of the cryptographic features provided or used by .NET and know how to work with them.  Know how to decide when to use SSL-based encryption and when to use explicitly coded encryption. Know the steps required to encrypt a data item.