A Java web application has a session timeout of 30 minutes. Users complain that they are logged out while filling out a long form. The security team wants to reduce the risk of session hijacking. Which approach best balances usability and security?

Disable session timeout entirely.

Implement an idle timeout that resets on any user activity, including AJAX requests.

Increase the session timeout to 2 hours.

Use an absolute timeout of 30 minutes regardless of activity.

Which property is most important for a secure session ID?

Short length for easy transmission

A Java EE application uses a single HttpSession for both pre-login and post-login state. After login, the application calls request.changeSessionId(). However, a security review notes that the session still contains attributes set before login, such as a 'role' attribute that was set to 'guest'. What is the most secure approach?

Use request.changeSessionId() and clear all attributes manually.

Invalidate the old session and create a new one, copying only necessary attributes.

Keep the existing session and change the 'role' attribute to 'user'.

Do nothing because changeSessionId() already prevents fixation.

EC-CouncilCertified Application Security Engineer (Java)

Domain 6Objective 1

Session Management Techniques CASEJAVA Practice Questions (Page 8)

Part of the Secure Coding: Session Management domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 36–40

36foundation · easy
What is the default session fixation protection strategy in Spring Security?
Select an answer first
37foundation · easy
Which cookie attribute prevents client-side scripts from accessing the session ID?
Select an answer first
38expert · hard
A Java web application has a session timeout of 30 minutes. Users complain that they are logged out while filling out a long form. The security team wants to reduce the risk of session hijacking. Which approach best balances usability and security?
Select an answer first
39foundation · easy
Which property is most important for a secure session ID?
Select an answer first
40expert · hard
A Java EE application uses a single HttpSession for both pre-login and post-login state. After login, the application calls request.changeSessionId(). However, a security review notes that the session still contains attributes set before login, such as a 'role' attribute that was set to 'guest'. What is the most secure approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Session Management Techniques CASEJAVA Practice Questions (Page 8)

Questions 36–40

What is the default session fixation protection strategy in Spring Security?

Which cookie attribute prevents client-side scripts from accessing the session ID?

A Java web application has a session timeout of 30 minutes. Users complain that they are logged out while filling out a long form. The security team wants to reduce the risk of session hijacking. Which approach best balances usability and security?

Which property is most important for a secure session ID?

Keep studying — Secure Coding: Session Management