Defensive Coding Against Broken Session Management CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Java application allows users to log in via a single sign-on (SSO) system. After the SSO callback authenticates the user, the application creates a local session. A security review notes that the local session ID is the same as the one used before the SSO callback. What is the risk and the appropriate fix?

   • ARisk of session fixation; fix by calling request.changeSessionId() after the SSO callback.
   • BRisk of session prediction; fix by using a longer session ID.
   • CRisk of session hijacking; fix by binding the session to the IP address.
   • DRisk of session timeout; fix by increasing the session timeout.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A Java application allows users to log in from multiple devices, including shared computers. The security team wants to detect session hijacking but also wants to allow users to switch between devices without re-authenticating every time. Which approach best meets both goals?

   • ABind the session to the IP address and invalidate on any change.
   • BRegenerate the session ID on every request and require re-authentication if the ID changes.
   • CUse a short idle timeout of 5 minutes to limit the window for hijacking.
   • DUse a device fingerprint (e.g., user-agent and a client-generated token) and require re-authentication only when the fingerprint changes.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Java application is being redesigned to use custom session IDs. The requirement is that session IDs must be unpredictable and resistant to brute-force attacks. Which implementation is most appropriate?

   • AGenerate a 32-bit random value using SecureRandom and use it directly as the session ID.
   • BGenerate a 256-bit random value using SecureRandom and Base64-encode it for the session ID.
   • CUse the user's username concatenated with a timestamp as the session ID.
   • DUse a hash of the user's password as the session ID.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is it important to clear the session cookie on the client side during logout?

   • ATo remove the session ID from the browser so it cannot be reused
   • BTo ensure the user is redirected to the home page
   • CTo prevent the browser from storing any cookies
   • DTo speed up the logout process
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why is it recommended to renew (regenerate) the session ID after a user logs in?

   • ATo extend the session timeout
   • BTo ensure the session is stored on the server
   • CTo prevent session fixation attacks
   • DTo reduce the size of the session cookie
   Reveal Solution Discussion Select an answer first