ASP.NET Interview Questions and Answers

1. What is the difference between .NET Core and .NET Framework?

Answer:

• .NET Framework: Windows-only, monolithic, and supports Web Forms.

• .NET Core: Cross-platform, modular, and optimized for cloud-based applications.

• .NET (Latest .NET 5, 6, 7, 8+): Unifies .NET Core and .NET Framework, with better performance and features.

• ​

2. What are Minimal APIs in ASP.NET Core?

Answer:
Minimal APIs allow lightweight API development without controllers.

Example:

csharp

CopyEdit

var builder = WebApplication.CreateBuilder(args); var app = builder.Build(); app.MapGet("/hello", () => "Hello World"); app.Run();

​

3. How does ASP.NET Core handle Dependency Injection (DI)?

Answer:
ASP.NET Core has built-in DI, configured in Program.cs:

csharp

CopyEdit

builder.Services.AddScoped<IMyService, MyService>();

It injects dependencies via constructor injection:

csharp

CopyEdit

public class MyController(IMyService service) { ... }

​

4. What is the difference between AddScoped, AddTransient, and AddSingleton in DI?

Answer:

• AddScoped: One instance per request.

• AddTransient: A new instance per injection.

• AddSingleton: A single instance for the entire application.

• ​

5. What is Middleware and how do you create custom Middleware?

Answer:
Middleware processes HTTP requests and responses in ASP.NET Core.

Example of custom middleware:

csharp

CopyEdit

public class CustomMiddleware(RequestDelegate next) { public async Task Invoke(HttpContext context) { // Custom logic await next(context); } } app.UseMiddleware<CustomMiddleware>();

​

6. How does ASP.NET Core handle Authentication and Authorization?

Answer:

• Authentication verifies identity (JWT, OAuth, Cookie).

• Authorization defines access control ([Authorize], policies, roles).

Example:

csharp

CopyEdit

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) .AddJwtBearer();

​

7. How do you implement JWT Authentication in ASP.NET Core?

Answer:

csharp

CopyEdit

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) .AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, ValidateAudience = true, ValidateLifetime = true, ValidateIssuerSigningKey = true }; });

​

8. What is CORS and how do you enable it?

Answer:
CORS (Cross-Origin Resource Sharing) allows API calls from different domains.

Enable it in Program.cs:

csharp

CopyEdit

builder.Services.AddCors(options => { options.AddPolicy("AllowAll", builder => builder.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader()); }); app.UseCors("AllowAll");

​

9. How do you improve the performance of an ASP.NET application?

Answer:

• Use Response Caching and Output Caching.

• Optimize database queries (use Dapper or EF Core Lazy Loading).

• Use Asynchronous Programming (async/await).

• Enable Compression (Gzip, Brotli).

• ​

10. What is the difference between Response Caching and Output Caching?

Answer:

• Response Caching: Caches response headers for clients.

• Output Caching: Caches rendered output for performance.

Example:

csharp

CopyEdit

[ResponseCache(Duration = 60, Location = ResponseCacheLocation.Client)] public IActionResult CachedAction() { ... }

​

11. How does ASP.NET Core achieve cross-platform compatibility?

Answer:
ASP.NET Core is built on the .NET Core runtime, which is cross-platform and modular. It uses:

• Platform-independent libraries

• Dependency Injection

• Kestrel server

• Middleware pipeline for HTTP request handling

12. Explain Middleware in ASP.NET Core.

Answer:
Middleware are components in the HTTP request pipeline that can:

• Handle requests/responses

• Short-circuit the pipeline

• Add headers, handle errors, authentication, etc.

app.Use(async (context, next) => { // Custom logic await next.Invoke(); // Call next middleware });

​

13. How does Dependency Injection (DI) work in ASP.NET Core?

Answer:
ASP.NET Core has built-in support for DI. Services are registered in Startup.cs:

services.AddScoped<IMyService, MyService>();

And injected via constructors:

public class MyController : Controller { private readonly IMyService _service; public MyController(IMyService service) => _service = service; }

​

14. What is Kestrel in ASP.NET Core?

Answer:
Kestrel is a lightweight, high-performance web server built into ASP.NET Core. It can be used alone or behind reverse proxies like Nginx/IIS.

​

15. What is the difference between IActionResult and ActionResult<T>?

Answer:

• IActionResult: Can return various types like View(), Json(), Redirect(), etc.

• ActionResult<T>: Combines strong typing with action result return types, useful for APIs.

public ActionResult<User> GetUser() => Ok(new User());

​

16. How does ASP.NET Core handle configuration?

Answer:

• Uses appsettings.json, environment variables, user secrets, etc.

• Configuration is loaded into a hierarchical system using IConfiguration.

var connectionString = Configuration["ConnectionStrings:Default"];

​

17. What is the use of the app.UseEndpoints method?

Answer:
Used in the endpoint routing system to define how routes map to endpoints (e.g., controllers, Razor Pages, etc.).

app.UseEndpoints(endpoints => { endpoints.MapControllers(); endpoints.MapRazorPages(); });

​

18. How do you implement Authentication and Authorization in ASP.NET Core?

Answer:

• Authentication: via cookies, JWT, or external providers.

• Authorization: via [Authorize], policies, or roles.

Setup in Startup.cs:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) .AddJwtBearer(...); services.AddAuthorization(options => { options.AddPolicy("AdminPolicy", policy => policy.RequireRole("Admin")); });

​

19. What is SignalR in ASP.NET Core?

Answer:
SignalR is a library for real-time communication (WebSockets). It's used for features like chat apps, live dashboards, and notifications.

services.AddSignalR(); endpoints.MapHub<ChatHub>("/chathub");

​

20. How do you secure an ASP.NET Core API?

Answer:

• Use HTTPS

• Implement JWT authentication

• Add rate limiting

• Use CORS policies

• Implement input validation and model binding protection

• Use anti-forgery tokens (where applicable)

21. Q: How do you implement custom HTTP modules and what are they used for in ASP.NET?
A:
Custom HTTP modules are classes that handle application-level events during the request pipeline, such as BeginRequest, AuthenticateRequest, or EndRequest. They are used for logging, authentication, compression, or request modification.

Example:

Public Class MyModule Implements IHttpModule Public Sub Init(context As HttpApplication) Implements IHttpModule.Init AddHandler context.BeginRequest, AddressOf OnBeginRequest End Sub Private Sub OnBeginRequest(sender As Object, e As EventArgs) ' Custom logic before request reaches handler End Sub Public Sub Dispose() Implements IHttpModule.Dispose ' Cleanup code End Sub End Class

You register modules in web.config under <httpModules> (IIS 6) or <system.webServer><modules> (IIS 7+).

​

22. Q: What is Output Caching in ASP.NET and how can you control it?
A:
Output Caching stores the rendered HTML of a page or control to reduce processing time on subsequent requests. You can control it using the @OutputCache directive or programmatically.

Example:

<%@ OutputCache Duration="60" VaryByParam="None" %>

You can also use VaryByParam, VaryByHeader, and VaryByCustom for more granular control.

​

23. Q: What is the role of the HttpContext object in ASP.NET?
A:
HttpContext provides information about the current HTTP request, response, session, server, and user. It's available via HttpContext.Current and is essential for low-level request handling and state management.

Example:

Dim userIP As String = HttpContext.Current.Request.UserHostAddress

​

24. Q: How can you secure an ASP.NET application using Forms Authentication?
A:
Forms Authentication uses a login form to authenticate users. It is configured in web.config by setting authentication mode="Forms" and specifying loginUrl.

Example in Web.config:

<authentication mode="Forms"> <forms loginUrl="Login.aspx" timeout="30" /> </authentication> <authorization> <deny users="?" /> </authorization>

Authenticated users receive a cookie that identifies them in future requests.

​

25. Q: What are asynchronous controllers in ASP.NET MVC, and why use them?
A:
Asynchronous controllers allow non-blocking I/O operations (e.g., file, database, or API calls), which frees up threads and improves scalability.

Example in VB.NET:

Async Function GetData() As Task(Of ActionResult) Dim result = Await SomeAsyncService.GetDataAsync() Return View(result) End Function

They’re useful when the controller action performs long-running operations but doesn’t require CPU-intensive processing.

​