Defensive Coding Against Broken Session Management CASEJAVA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A Java application accepts a session ID from a request parameter if no cookie is present. After login, the application does not change the session ID. Which two changes are most important to prevent session fixation?

   • AUse a longer session ID and set a shorter timeout.
   • BReject session IDs from request parameters and regenerate the session ID after authentication.
   • CStore the session ID in a hidden form field and validate it on each request.
   • DBind the session to the user's IP and require re-authentication on IP change.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A Java application is accessible via both HTTP and HTTPS. The session cookie is set without the Secure attribute, and the application uses URL rewriting as a fallback when cookies are disabled. A security audit requires that session IDs never be transmitted over HTTP or appear in URLs. What is the most effective configuration?

   • AKeep URL rewriting but add a `<meta http-equiv="referrer" content="no-referrer">` tag.
   • BForce HTTPS for all requests, disable URL rewriting, and set the Secure and HttpOnly attributes on the session cookie.
   • CSet the Secure attribute on the cookie but allow HTTP access for non-sensitive pages.
   • DUse a client-side script to strip the session ID from URLs before navigation.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Why should session IDs be transmitted only over HTTPS?

   • ATo prevent the server from logging session IDs
   • BTo increase the speed of session ID transmission
   • CTo allow session IDs to be stored in URLs
   • DTo prevent interception by attackers on the network
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A Java web application currently uses URL rewriting as a session tracking mode because some users disable cookies. A security audit flags that session IDs appear in server logs and in the Referer header when users click external links. What is the best remediation?

   • ADisable cookies entirely and rely on hidden form fields for session tracking.
   • BKeep URL rewriting but add a `<base>` tag to all pages.
   • CSwitch to cookie-based session tracking and set the HttpOnly and Secure attributes on the session cookie.
   • DUse URL rewriting but strip the session ID from server logs.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   In a Java servlet, which method is used to invalidate the current session?

   • Asession.close()
   • Bsession.remove()
   • Csession.invalidate()
   • Dsession.destroy()
   Reveal Solution Discussion Select an answer first