Session Management Techniques CASEJAVA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A Java web application uses HttpSession to store a user's shopping cart. After a user logs in, the application continues using the same session ID that was issued before authentication. The security team has flagged this as a session fixation risk. Which change should the application make?

   • AUse a longer session ID generated by the container's default algorithm.
   • BRegenerate the session ID immediately after successful authentication.
   • CSet the session cookie's Max-Age to 30 minutes.
   • DStore the session ID in a hidden form field instead of a cookie.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A penetration tester is assessing a Java application's session management. The tester captures a session ID and then logs in from a different browser using the same session ID. The application accepts the session ID and grants access. Which vulnerability is confirmed?

   • ASession timeout misconfiguration
   • BSession fixation
   • CSession hijacking
   • DSession ID entropy weakness
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the recommended minimum length for a session ID to resist brute-force attacks?

   • A64 bits
   • B8 bits
   • C32 bits
   • D128 bits
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A Java web application is being designed for a public-facing site. The team wants to track user preferences without requiring login. They plan to use HttpSession. Which consideration is most important for securing this anonymous session?

   • AUse a secure random session ID and set the cookie with Secure and HttpOnly flags.
   • BSet the session timeout to 0 to disable expiration.
   • CDo not use sessions because the user is not authenticated.
   • DStore preferences in a client-side cookie instead.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A development team is reviewing the session ID generation in their Java EE application. They currently use a custom generator that produces a 32-bit random number and encodes it as a hexadecimal string. The security review recommends increasing the entropy of session IDs. What is the most effective improvement?

   • AEncode the existing 32-bit value using Base64 instead of hexadecimal.
   • BUse the current timestamp in milliseconds as the seed for the random generator.
   • CUse a cryptographically secure random number generator to produce at least 128 bits of entropy.
   • DAppend the user's IP address to the session ID before hashing.
   Reveal Solution Discussion Select an answer first