Session Management Techniques CASEJAVA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A Java application is accessed by users on both regular browsers and legacy mobile clients that do not support the SameSite cookie attribute. The application currently sets a session cookie with Secure and HttpOnly but not SameSite. A penetration test shows that the session cookie is sent in cross-site requests. What is the best mitigation that does not break the legacy clients?

   • ASet SameSite=Lax on the session cookie.
   • BImplement CSRF tokens in addition to the existing cookie flags.
   • CDisable cookies and use URL rewriting.
   • DSet SameSite=Strict on the session cookie.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A Java application is accessed over HTTPS, but the session cookie is set without the Secure flag. The application also allows session IDs to be passed in URLs. Which of the following is the most comprehensive mitigation?

   • ABind the session to the user's IP address
   • BUse a shorter session timeout
   • CSet the Secure flag on the cookie and disable URL-based session rewriting
   • DSet the HttpOnly flag on the cookie
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A Spring Security application uses session fixation protection with migrateSession(). A security audit recommends using newSession() instead. What is the primary security advantage of newSession() over migrateSession()?

   • AIt creates a completely new session object, discarding any pre-authentication attributes.
   • BIt automatically sets the HttpOnly flag.
   • CIt changes the session ID more frequently.
   • DIt uses a stronger random number generator.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   When should a web application regenerate the session ID to prevent fixation?

   • AWhen the user changes their password
   • BImmediately after a user successfully authenticates
   • COnly when the session expires
   • DAt the beginning of every HTTP request
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A Java web application is deployed behind a load balancer that terminates SSL. The application sets a session cookie with the Secure flag. Users report that they are logged out frequently. What is the likely cause?

   • AThe application is not aware that the original request was HTTPS, so it may not send the Secure cookie correctly
   • BThe session timeout is too short
   • CThe cookie domain is set incorrectly
   • DThe load balancer is not sticky, so sessions are lost
   Reveal Solution Discussion Select an answer first