A Java web application using Spring Security allows users to log in with credentials. After successful authentication, the application redirects the user to a dashboard. A security review flags a potential session fixation vulnerability. Which configuration change best mitigates this risk?

Enable session fixation protection in Spring Security so the session ID is changed upon login

Set the session timeout to 30 minutes in web.xml

Store the session ID in a hidden form field instead of a cookie

Use a custom filter that deletes all cookies after logout

A Java web application is deployed behind a load balancer that terminates TLS. The application sets a session cookie without the Secure flag because the traffic between the load balancer and the application server is HTTP. A security review recommends enforcing HTTPS end-to-end. What is the best way to protect the session cookie in this architecture?

Set the Secure flag on the session cookie and ensure the application only receives requests via HTTPS from the load balancer.

Remove the Secure flag and rely on the load balancer's TLS termination.

Store the session ID in the URL instead of a cookie.

Use a different cookie name for HTTPS requests.

A Java web application uses HttpSession to track user preferences. The application is stateless and does not use cookies. The developer wants to maintain session state across requests. Which approach is the most secure and practical?

Use a hidden form field to store the session ID.

Use URL rewriting to pass the session ID in every link.

Store the session ID in a client-side JavaScript variable.

Use a cookie with the Secure and HttpOnly flags.

A security tester is auditing a Java web application's session management. The tester captures a session cookie and then attempts to use it from a different browser and IP address. The application still accepts the session. Which finding is most accurate?

The session cookie is missing the HttpOnly flag.

The session timeout is too long.

The session is not bound to a client attribute, allowing session hijacking if the cookie is stolen.

The session ID has insufficient entropy.

A developer is implementing a custom session ID generator for a Java application. The current implementation uses java.util.Random with a 32-bit seed. A security review demands a cryptographically secure session ID. What should the developer do?

Use Math.random() and concatenate two calls

Use SecureRandom with at least 128 bits of entropy

Increase the seed to 64 bits with java.util.Random

Use a timestamp and user ID as the session ID

EC-CouncilCertified Application Security Engineer (Java)

Domain 6Objective 1

Session Management Techniques CASEJAVA Practice Questions (Page 5)

Part of the Secure Coding: Session Management domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 21–25

21application · medium
A Java web application using Spring Security allows users to log in with credentials. After successful authentication, the application redirects the user to a dashboard. A security review flags a potential session fixation vulnerability. Which configuration change best mitigates this risk?
Select an answer first
22application · medium
A Java web application is deployed behind a load balancer that terminates TLS. The application sets a session cookie without the Secure flag because the traffic between the load balancer and the application server is HTTP. A security review recommends enforcing HTTPS end-to-end. What is the best way to protect the session cookie in this architecture?
Select an answer first
23application · medium
A Java web application uses HttpSession to track user preferences. The application is stateless and does not use cookies. The developer wants to maintain session state across requests. Which approach is the most secure and practical?
Select an answer first
24application · medium
A security tester is auditing a Java web application's session management. The tester captures a session cookie and then attempts to use it from a different browser and IP address. The application still accepts the session. Which finding is most accurate?
Select an answer first
25application · medium
A developer is implementing a custom session ID generator for a Java application. The current implementation uses java.util.Random with a 32-bit seed. A security review demands a cryptographically secure session ID. What should the developer do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.