What is a common technique to detect session hijacking?

Encrypting the session ID with the user's password

Comparing the user's IP address and User-Agent string with the values recorded at session creation

Storing the session ID in a JavaScript variable

Which of the following is a risk of placing session IDs in URLs?

Session IDs are visible only to the server

Session IDs become too long for the server to handle

Session IDs may leak via browser history and referrer headers

Session IDs are automatically encrypted by the browser

A Java application generates session IDs using `UUID.randomUUID().toString().replace("-", "")`. A security review notes that UUIDs are not cryptographically random and may be predictable. Which approach should be used to generate session IDs?

Use `SecureRandom` to generate at least 128 bits of randomness and encode it with Base64URL.

Use `Random` with a seed of `System.nanoTime()`.

Use the current timestamp combined with the user's IP address.

Use `Math.random()` to generate a 32-character string.

EC-CouncilCertified Application Security Engineer (Java)

Domain 6Objective 2

Defensive Coding Against Broken Session Management CASEJAVA Practice Questions (Page 7)

Part of the Secure Coding: Session Management domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 31–35

31application · medium
A Java servlet application sets a session cookie using `response.addCookie(new Cookie("JSESSIONID", session.getId()))`. The application is served over HTTPS, but users report that the session sometimes appears in HTTP referrer headers when they click external links. Which cookie attribute should be added to mitigate this exposure?
Select an answer first
32foundation · easy
What is a common technique to detect session hijacking?
Select an answer first
33foundation · easy
Which of the following is a risk of placing session IDs in URLs?
Select an answer first
34foundation · easy
Which Java API is recommended for generating cryptographically strong random session IDs?
Select an answer first
35application · medium
A Java application generates session IDs using `UUID.randomUUID().toString().replace("-", "")`. A security review notes that UUIDs are not cryptographically random and may be predictable. Which approach should be used to generate session IDs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Defensive Coding Against Broken Session Management CASEJAVA Practice Questions (Page 7)

Questions 31–35

What is a common technique to detect session hijacking?

Which of the following is a risk of placing session IDs in URLs?

Which Java API is recommended for generating cryptographically strong random session IDs?

A Java application generates session IDs using `UUID.randomUUID().toString().replace("-", "")`. A security review notes that UUIDs are not cryptographically random and may be predictable. Which approach should be used to generate session IDs?

Keep studying — Secure Coding: Session Management