Which of the following is an effective defense against session hijacking?

Storing the session ID in a URL parameter

Using the Secure and HttpOnly flags on the session cookie

Accepting any session ID provided by the client

A Java web application is experiencing brute-force attacks on its login form. The security team wants to implement a defense that is effective without requiring additional hardware. Which approach is most appropriate?

Disable the login form and use HTTP Basic authentication

Implement account lockout after a certain number of failed attempts

A Java web application uses a session timeout of 30 minutes. A security audit recommends reducing the timeout to 10 minutes to reduce the risk of session hijacking. However, users complain about being logged out too frequently. What is the best approach to balance security and usability?

Use a 10-minute timeout for all users, regardless of activity.

Use a 10-minute timeout but allow users to extend it with a button.

Keep the 30-minute timeout but add a 'Remember Me' feature.

Implement an idle timeout of 10 minutes and an absolute timeout of 2 hours.

A Java servlet application uses form-based authentication. After a successful login, the application creates a new session and invalidates the old one. The application also sets the session timeout to 15 minutes. Which additional control is most important to prevent session hijacking?

Store the session ID in a hidden form field

Set the session cookie to be secure and HttpOnly

Use a longer session timeout of 30 minutes

Regenerate the session ID only when the user logs out

EC-CouncilCertified Application Security Engineer (Java)

Domain 4Objective 2

Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 3)

Part of the Secure Coding: Authentication and Authorization domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 11–15

11foundation · easy
Which of the following is an effective defense against session hijacking?
Select an answer first
12foundation · easy
Which password hashing algorithm is specifically designed to be computationally expensive and includes a per-password salt, making it resistant to brute-force and rainbow-table attacks?
Select an answer first
13application · medium
A Java web application is experiencing brute-force attacks on its login form. The security team wants to implement a defense that is effective without requiring additional hardware. Which approach is most appropriate?
Select an answer first
14expert · hard
A Java web application uses a session timeout of 30 minutes. A security audit recommends reducing the timeout to 10 minutes to reduce the risk of session hijacking. However, users complain about being logged out too frequently. What is the best approach to balance security and usability?
Select an answer first
15application · medium
A Java servlet application uses form-based authentication. After a successful login, the application creates a new session and invalidates the old one. The application also sets the session timeout to 15 minutes. Which additional control is most important to prevent session hijacking?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.