A Java servlet application sets a session cookie using response.addCookie(). The application is served over HTTPS, but users sometimes access it via HTTP due to an old bookmark. A security audit recommends preventing session hijacking via cookie theft. Which cookie attribute combination should be applied?

setDomain("example.com") and setSecure(false)

setHttpOnly(true) and setMaxAge(-1)

setSecure(true) and setHttpOnly(true)

setMaxAge(3600) and setPath("/")

Which action should be taken when a user logs out of an application?

Invalidate the session and remove the session cookie

Only clear the session cookie on the client

Regenerate the session ID but keep the session active

Leave the session active for a short period in case the user returns

What is the purpose of an idle session timeout?

To invalidate a session after a period of inactivity

To regenerate the session ID periodically

To limit the total lifetime of a session regardless of activity

To encrypt the session data on the server

A developer is designing a session ID for a high-security Java application. The requirement is that the session ID must be resistant to brute-force guessing. Which characteristic is most important?

A value that includes the server's IP address

A value based on the user's username

A long random value generated with a cryptographically secure PRNG

A short value that is easy to remember

A Java web application has a session timeout configured in web.xml. During a penetration test, the tester finds that an authenticated session remains valid indefinitely if the user closes the browser and reopens it within a short time. The application uses a persistent cookie for the session ID. What is the most effective fix?

Set the cookie's Max-Age to match the session timeout

Store the session ID in a URL parameter

Use a non-persistent cookie for the session ID

Increase the session timeout to 60 minutes

EC-CouncilCertified Application Security Engineer (Java)

Domain 6Objective 1

Session Management Techniques CASEJAVA Practice Questions (Page 3)

Part of the Secure Coding: Session Management domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 11–15

11application · medium
A Java servlet application sets a session cookie using response.addCookie(). The application is served over HTTPS, but users sometimes access it via HTTP due to an old bookmark. A security audit recommends preventing session hijacking via cookie theft. Which cookie attribute combination should be applied?
Select an answer first
12foundation · easy
Which action should be taken when a user logs out of an application?
Select an answer first
13foundation · easy
What is the purpose of an idle session timeout?
Select an answer first
14application · medium
A developer is designing a session ID for a high-security Java application. The requirement is that the session ID must be resistant to brute-force guessing. Which characteristic is most important?
Select an answer first
15application · medium
A Java web application has a session timeout configured in web.xml. During a penetration test, the tester finds that an authenticated session remains valid indefinitely if the user closes the browser and reopens it within a short time. The application uses a persistent cookie for the session ID. What is the most effective fix?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Session Management Techniques CASEJAVA Practice Questions (Page 3)

Questions 11–15

Which action should be taken when a user logs out of an application?

What is the purpose of an idle session timeout?

A developer is designing a session ID for a high-security Java application. The requirement is that the session ID must be resistant to brute-force guessing. Which characteristic is most important?

Keep studying — Secure Coding: Session Management