A Spring Boot application uses Spring Security and is deployed behind a reverse proxy that handles SSL. The application sets the session cookie with the Secure flag. Users on HTTPS connections are still able to log in, but the session cookie is not being set in the browser. What is the most likely cause?

The session timeout is set to zero

The cookie domain is set to localhost

The reverse proxy is stripping the Set-Cookie header

The application is not configured to trust the X-Forwarded-Proto header, so it thinks the request is HTTP and does not send the Secure cookie

Which testing technique is used to determine if a session ID is predictable?

Analyzing a large sample of session IDs for patterns

Checking if the session cookie has the HttpOnly flag

Using a brute-force tool to guess the session ID

Sending a specially crafted HTTP request to trigger an error

A security audit of a Java application finds that session IDs are generated using java.util.Random seeded with the current time. The application is high-traffic and requires low latency. Which remediation is the best balance of security and performance?

Keep java.util.Random but increase the ID length to 256 bits.

Use a UUID generated by UUID.randomUUID().

Use a hash of the user's password as the session ID.

Replace java.util.Random with java.security.SecureRandom and increase the ID length to 128 bits.

A Spring Security application uses form login. The security team wants to ensure that a session fixation attack cannot succeed. Which Spring Security feature should be enabled?

sessionManagement().sessionFixation().migrateSession()

http.rememberMe().key("secret")

sessionManagement().maximumSessions(1)

Why should a session ID cookie be transmitted only over HTTPS?

To ensure the cookie is stored on the server

To prevent the cookie from being sent to other domains

To allow the cookie to be accessed by JavaScript

To prevent interception of the session ID over unencrypted connections

EC-CouncilCertified Application Security Engineer (Java)

Domain 6Objective 1

Session Management Techniques CASEJAVA Practice Questions (Page 1)

Part of the Secure Coding: Session Management domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 1–5

1expert · hard
A Spring Boot application uses Spring Security and is deployed behind a reverse proxy that handles SSL. The application sets the session cookie with the Secure flag. Users on HTTPS connections are still able to log in, but the session cookie is not being set in the browser. What is the most likely cause?
Select an answer first
2foundation · easy
Which testing technique is used to determine if a session ID is predictable?
Select an answer first
3expert · hard
A security audit of a Java application finds that session IDs are generated using java.util.Random seeded with the current time. The application is high-traffic and requires low latency. Which remediation is the best balance of security and performance?
Select an answer first
4application · medium
A Spring Security application uses form login. The security team wants to ensure that a session fixation attack cannot succeed. Which Spring Security feature should be enabled?
Select an answer first
5foundation · easy
Why should a session ID cookie be transmitted only over HTTPS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.