Defensive Coding Against Broken Session Management CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A Java web application uses a custom authentication filter that sets the user principal after verifying credentials. The filter currently does not change the session ID. A security audit recommends regenerating the session ID after authentication. However, the application also uses a shopping cart that is stored in the session before login. What is the best way to preserve the cart while preventing session fixation?

   • ARegenerate the session ID and accept that the cart is lost.
   • BStore the cart in a cookie and clear the session after authentication.
   • CDo not regenerate the session ID because the cart must be preserved.
   • DCopy the cart data to a new session after calling request.changeSessionId(), then invalidate the old session.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common session-related vulnerability where an attacker forces a user to use a known session ID?

   • ASession prediction
   • BSession hijacking
   • CSession fixation
   • DSession timeout
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Java web application's logout function calls session.invalidate() and then redirects to the login page. However, a tester finds that pressing the browser Back button after logout shows cached authenticated pages. Which additional control should be implemented to prevent cached page access?

   • AClear the session cookie by setting Max-Age=0 in the logout response.
   • BUse a JavaScript redirect to the login page after logout.
   • CSet the session timeout to 1 minute after logout.
   • DSet HTTP response headers Cache-Control: no-store and Pragma: no-cache on authenticated pages.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of the HttpOnly attribute on a session cookie?

   • ATo ensure the cookie is only sent over HTTPS
   • BTo prevent client-side scripts from accessing the cookie
   • CTo make the cookie expire after the browser is closed
   • DTo restrict the cookie to a specific domain
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A web application allows users to log in from multiple devices. The security team wants to detect potential session hijacking without forcing users to re-authenticate on every IP change. Which approach best balances security and usability?

   • AStore the session ID in a JavaScript variable and compare it on each request.
   • BInvalidate the session immediately whenever the IP address changes.
   • CBind the session to the user-agent only and ignore IP changes.
   • DTrack the IP address and user-agent per session and flag or require step-up verification when they change significantly.
   Reveal Solution Discussion Select an answer first