A Java application allows users to change their password from within an authenticated session. After the password change, the application should invalidate all other active sessions for that user. Which approach should be implemented?

Clear the session cookie in the response after password change.

Set a short idle timeout for all sessions after password change.

Maintain a session registry per user and invalidate all sessions except the current one after password change.

Call request.changeSessionId() on the current session after password change.

What is the most important server-side action when a user logs out?

Invalidating the session on the server (e.g., calling session.invalidate())

Redirecting the user to the login page

A Java web application's logout function invalidates the server-side session and clears the session cookie. However, a security tester discovers that after logout, the session ID can still be used to access protected resources if the attacker sends the old session ID in a request. The application uses a distributed session store. What is the most likely cause and the best fix?

The session cookie is not being cleared; clear the cookie with Max-Age=0.

The session invalidation is not propagated to all nodes in the distributed cache; use a centralized session store with immediate invalidation or a versioned session token.

The session ID is being regenerated on logout; disable regeneration.

The session timeout is too long; reduce the timeout to 1 minute.

A high-security application requires protection against session hijacking, but users frequently switch between corporate Wi-Fi and personal hotspots, causing IP changes. The security team wants to minimize false positives while still detecting stolen sessions. Which strategy is most effective?

Implement risk-based session binding: record IP and user-agent, and require step-up authentication (e.g., MFA) when the IP changes to a different geographic region or the user-agent changes.

Use a short absolute timeout of 5 minutes to limit the window for hijacking.

Bind the session to the user-agent only and ignore IP changes.

Bind the session to the IP address and invalidate on any change.

What is an idle timeout in session management?

The time after which a session expires if there is no user activity

The maximum time a session can be active regardless of user activity

The time a user must wait before logging in again

The time it takes for the server to process a request

EC-CouncilCertified Application Security Engineer (Java)

Domain 6Objective 2

Defensive Coding Against Broken Session Management CASEJAVA Practice Questions (Page 1)

Part of the Secure Coding: Session Management domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 1–5

1application · medium
A Java application allows users to change their password from within an authenticated session. After the password change, the application should invalidate all other active sessions for that user. Which approach should be implemented?
Select an answer first
2foundation · easy
What is the most important server-side action when a user logs out?
Select an answer first
3expert · hard
A Java web application's logout function invalidates the server-side session and clears the session cookie. However, a security tester discovers that after logout, the session ID can still be used to access protected resources if the attacker sends the old session ID in a request. The application uses a distributed session store. What is the most likely cause and the best fix?
Select an answer first
4expert · hard
A high-security application requires protection against session hijacking, but users frequently switch between corporate Wi-Fi and personal hotspots, causing IP changes. The security team wants to minimize false positives while still detecting stolen sessions. Which strategy is most effective?
Select an answer first
5foundation · easy
What is an idle timeout in session management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.