A Java EE application allows users to log in. The current code does not invalidate the existing session before creating a new one after login. A security auditor identifies a session fixation vulnerability. Which code change is the most appropriate fix?

Call session.setMaxInactiveInterval(0) after login.

Use session.invalidate() and then create a new session with the same ID.

Store the session ID in a cookie with the Secure flag.

Call request.changeSessionId() after successful authentication.

A Java EE application is being migrated from a single server to a cluster. Currently, HttpSession data is stored in memory. The migration team wants to maintain session state across servers. Which approach is the most secure and scalable?

Use a distributed cache like Redis to store session data, with the session ID as the key.

Enable sticky sessions on the load balancer.

Use URL rewriting to pass the session ID.

Store session data in a database table.

EC-CouncilCertified Application Security Engineer (Java)

Domain 6Objective 1

Session Management Techniques CASEJAVA Practice Questions (Page 10)

Part of the Secure Coding: Session Management domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 46–47

46application · medium
A Java EE application allows users to log in. The current code does not invalidate the existing session before creating a new one after login. A security auditor identifies a session fixation vulnerability. Which code change is the most appropriate fix?
Select an answer first
47expert · hard
A Java EE application is being migrated from a single server to a cluster. Currently, HttpSession data is stored in memory. The migration team wants to maintain session state across servers. Which approach is the most secure and scalable?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Session Management Techniques CASEJAVA Practice Questions (Page 10)

Questions 46–47

A Java EE application allows users to log in. The current code does not invalidate the existing session before creating a new one after login. A security auditor identifies a session fixation vulnerability. Which code change is the most appropriate fix?

A Java EE application is being migrated from a single server to a cluster. Currently, HttpSession data is stored in memory. The migration team wants to maintain session state across servers. Which approach is the most secure and scalable?

Keep studying — Secure Coding: Session Management