What is the primary defense against session fixation attacks?

Regenerating the session ID after successful authentication

Setting the Secure flag on the session cookie

Storing the session ID in a hidden form field

During a security audit of a Java application, the tester checks whether session IDs are properly invalidated on the server after logout. Which test would best confirm this?

Check if the session cookie has the Secure flag

Verify the session timeout is set to 30 minutes

Log in, capture the session ID, log out, then replay the session ID in a request

Which technique helps mitigate session hijacking by ensuring the session ID is not exposed during transmission?

Disabling cookies and using hidden form fields

Storing the session ID in a URL parameter

Using a short session ID to reduce exposure

Using HTTPS for all communications

A Java servlet application stores sensitive user data in HttpSession. The application is deployed on a server that allows session data to be persisted to disk. The security team is concerned about local attackers reading session files. Which configuration change is most appropriate?

Increase the session timeout to 24 hours.

Set the HttpOnly flag on the session cookie.

Disable session persistence and store session data in memory only.

EC-CouncilCertified Application Security Engineer (Java)

Domain 6Objective 1

Session Management Techniques CASEJAVA Practice Questions (Page 2)

Part of the Secure Coding: Session Management domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 6–10

6foundation · easy
What is the primary defense against session fixation attacks?
Select an answer first
7application · medium
A Java web application sets its session cookie without any flags. A penetration test reveals that the session ID can be stolen via an XSS payload and also intercepted over an unencrypted HTTP connection. Which two cookie attributes should be set to mitigate these specific findings?
Select an answer first
8application · medium
During a security audit of a Java application, the tester checks whether session IDs are properly invalidated on the server after logout. Which test would best confirm this?
Select an answer first
9foundation · easy
Which technique helps mitigate session hijacking by ensuring the session ID is not exposed during transmission?
Select an answer first
10application · medium
A Java servlet application stores sensitive user data in HttpSession. The application is deployed on a server that allows session data to be persisted to disk. The security team is concerned about local attackers reading session files. Which configuration change is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.