Common Threats on Authentication and Authorization CASEJAVA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A Java web application allows users to log in with email and password. The security team notices a spike in failed login attempts from many different IP addresses, each trying a small number of common passwords for the same set of accounts. The application currently has no account lockout and uses a standard session cookie. Which combination of controls would most directly mitigate this credential stuffing attack while minimizing user disruption?

   • AAdd account lockout after three failed attempts and log all failures.
   • BDisable session cookies and use URL-based session tracking.
   • CIncrease password minimum length to 16 characters and require a special character.
   • DImplement multi-factor authentication and rate-limit login attempts per IP address.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A Java web application allows users to log in with a username and password. The application does not have any rate limiting or account lockout. An attacker uses a botnet to try thousands of password combinations for a single admin account. Which type of attack is this, and what is the most effective control?

   • ACredential stuffing; require multi-factor authentication.
   • BPhishing; educate users about suspicious emails.
   • CBrute force attack; implement account lockout and rate limiting on login attempts.
   • DSession hijacking; rotate session IDs after login.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An attacker intercepts a user's session token and then uses that token to make authenticated requests as the user. Which authentication threat does this describe?

   • ACredential stuffing
   • BBrute force attack
   • CMan-in-the-middle attack
   • DSession hijacking
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A Java application uses a session cookie that is valid for 8 hours. The application also has a 'remember me' feature that sets a persistent cookie. A security review finds that the persistent cookie is not cryptographically signed, allowing an attacker to modify it to impersonate another user. Which two vulnerabilities are present, and what is the most effective mitigation?

   • ASession hijacking and privilege escalation; sign the persistent cookie with a server-side secret and validate it on every request.
   • BCredential stuffing and privilege escalation; use MFA and role checks.
   • CBrute force and IDOR; use rate limiting and object-level authorization.
   • DSession fixation and forced browsing; regenerate session IDs and hide admin links.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A Java application uses session cookies that are not marked HttpOnly and have a fixed session ID that does not rotate after login. The application is deployed over HTTPS but also allows HTTP for some legacy pages. An attacker has already stolen a valid session ID via a cross-site scripting (XSS) vulnerability. Which combination of mitigations would most effectively reduce the risk of session hijacking while maintaining usability?

   • AKeep the session ID fixed but add a JavaScript-based session timeout that logs the user out after 5 minutes of inactivity.
   • BDisable HTTP entirely and rely on the existing session ID rotation that occurs only at the start of the session.
   • CMark cookies as HttpOnly and Secure, rotate the session ID after login, and enforce HTTPS site-wide by redirecting HTTP to HTTPS.
   • DUse a longer random session ID and store it in a JavaScript variable instead of a cookie to prevent cookie theft.
   Reveal Solution Discussion Select an answer first