Defensive Coding Against Broken Session Management CASEJAVA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Why should a web application reject user-supplied session identifiers (e.g., from a query parameter) and rely on server-generated IDs?

   • ATo reduce the amount of data sent to the server
   • BTo prevent attackers from forcing a known session ID on a victim
   • CTo make the session ID easier to remember
   • DTo ensure the session ID is encrypted
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A Java web application's logout button currently calls session.invalidate() but does not clear the session cookie. A user logs out on a shared computer, then presses the browser's Back button and observes that the application still shows the previous authenticated page. Which additional step should be implemented to prevent session reuse?

   • ARedirect the user to the login page using a 302 redirect.
   • BCall session.setMaxInactiveInterval(0) before invalidating.
   • CSet the session cookie's HttpOnly attribute to true after logout.
   • DDelete the session cookie by setting its Max-Age to 0 and Expires to a past date in the logout response.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which session tracking mode is generally considered the most secure in Java web applications?

   • ASSL session IDs
   • BCookies
   • CHidden form fields
   • DURL rewriting
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A Java application must enforce both an idle timeout of 15 minutes and an absolute timeout of 8 hours. The application is deployed on a cluster of servers, and sessions are stored in a distributed cache. Which implementation approach is most reliable?

   • AConfigure the container's session-timeout to 15 minutes and rely on the container to enforce the absolute timeout.
   • BStore the session creation timestamp in the session and use a servlet filter to check both idle and absolute timeouts on every request, invalidating if either is exceeded.
   • CUse a JavaScript timer to log the user out after 8 hours.
   • DSet the session cookie Max-Age to 8 hours and rely on the browser to expire the session.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary reason for generating session IDs with sufficient length and high entropy?

   • ATo make them harder to guess or brute-force
   • BTo reduce the size of the session cookie
   • CTo make the session ID easier to remember
   • DTo ensure compatibility with all browsers
   Reveal Solution Discussion Select an answer first