A Java application generates its own session IDs using java.util.Random with a 32-bit seed. A security review determines that session IDs are predictable. Which change should be made to generate secure session IDs?

Use the user's IP address and user-agent hash as the session ID.

Use java.util.Random with a larger seed, such as 64 bits.

Use SecureRandom with a 128-bit or larger random value and encode it appropriately for the session cookie.

Use the current timestamp in milliseconds as the session ID.

A Java web application uses cookies for session management. A developer notices that the session cookie is being sent on HTTP requests as well as HTTPS. The application is accessible via both HTTP and HTTPS. What is the most effective way to prevent the session cookie from being transmitted over HTTP?

Use a JavaScript redirect to force HTTPS before sending the cookie.

Set the cookie's Max-Age to a short value.

Set the Secure attribute on the session cookie.

Set the HttpOnly attribute on the session cookie.

Which of the following is the most effective defense against session fixation?

Regenerating the session ID after successful authentication

Setting the Secure flag on the session cookie

Binding the session to the user's IP address

A Java web application's logout button only redirects the user to the login page without invalidating the server-side session. A penetration test reveals that pressing the browser's Back button after logout restores the authenticated pages. What is the most effective fix?

Set the session cookie's Max-Age to zero and rely on the browser to delete it.

Call `request.getSession().invalidate()` and clear the session cookie with a zero Max-Age.

Remove all session attributes and keep the session object alive.

Redirect to the login page with a cache-control header of no-store.

Why should session binding to IP address be used with caution?

Because IP addresses are not unique to a user

Because a user's IP address can change legitimately (e.g., mobile networks, proxies)

Because IP addresses are not available in all browsers

Because IP addresses are encrypted in HTTP headers

EC-CouncilCertified Application Security Engineer (Java)

Domain 6Objective 2

Defensive Coding Against Broken Session Management CASEJAVA Practice Questions (Page 6)

Part of the Secure Coding: Session Management domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 26–30

26application · medium
A Java application generates its own session IDs using java.util.Random with a 32-bit seed. A security review determines that session IDs are predictable. Which change should be made to generate secure session IDs?
Select an answer first
27application · medium
A Java web application uses cookies for session management. A developer notices that the session cookie is being sent on HTTP requests as well as HTTPS. The application is accessible via both HTTP and HTTPS. What is the most effective way to prevent the session cookie from being transmitted over HTTP?
Select an answer first
28foundation · easy
Which of the following is the most effective defense against session fixation?
Select an answer first
29application · medium
A Java web application's logout button only redirects the user to the login page without invalidating the server-side session. A penetration test reveals that pressing the browser's Back button after logout restores the authenticated pages. What is the most effective fix?
Select an answer first
30foundation · easy
Why should session binding to IP address be used with caution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.