A Spring Security-based application allows users to log in from multiple devices. A security analyst wants to reduce the risk of session hijacking without forcing re-authentication on every request. Which approach is most effective?

Disable concurrent sessions so only one device can be logged in

Use a short idle timeout and require re-authentication for sensitive actions

Bind the session to the user's IP address and reject mismatches

Store the session ID in a cookie without Secure flag

Which statement best describes the role of a session identifier in a web application?

It is a unique token that links a user's requests to server-side session data

It is a certificate that proves the user's identity

It is a permanent identifier that never changes for a user

It is a secret key used to encrypt the user's password

What should an auditor verify to ensure session cookies are protected from XSS attacks?

The cookie is set using JavaScript

The cookie has the HttpOnly attribute set

The cookie has a long expiration time

A Java application has a session timeout of 30 minutes. A user logs in, uses the application for 10 minutes, then leaves the computer for 40 minutes. When they return, they click a link. What should happen?

The session is valid only if the user's IP address has not changed

The session is extended automatically because the user is authenticated

The session is invalidated because the idle timeout has been exceeded

The session is still valid because the timeout is based on total session duration

EC-CouncilCertified Application Security Engineer (Java)

Domain 6Objective 1

Session Management Techniques CASEJAVA Practice Questions (Page 6)

Part of the Secure Coding: Session Management domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 26–30

26application · medium
A Spring Security-based application allows users to log in from multiple devices. A security analyst wants to reduce the risk of session hijacking without forcing re-authentication on every request. Which approach is most effective?
Select an answer first
27foundation · easy
Which statement best describes the role of a session identifier in a web application?
Select an answer first
28foundation · easy
What should an auditor verify to ensure session cookies are protected from XSS attacks?
Select an answer first
29application · medium
A Java application has a session timeout of 30 minutes. A user logs in, uses the application for 10 minutes, then leaves the computer for 40 minutes. When they return, they click a link. What should happen?
Select an answer first
30foundation · easy
In Spring Security, which configuration element enables session fixation protection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.