ASP.NET Session Management Techniques CASENET Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which ASP.NET session state mode stores session data in the memory of the ASP.NET worker process?

   • ACustom
   • BStateServer
   • CInProc
   • DSQLServer
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A developer is implementing a login feature. After a user successfully authenticates, the application calls Session.Abandon() and then creates a new session. What is the primary security benefit of this approach?

   • AIt prevents session fixation by ensuring the session ID is changed after authentication
   • BIt reduces server memory usage by clearing all session data immediately
   • CIt ensures the session timeout is reset to the maximum value
   • DIt encrypts the session data stored on the server
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the web.config file, which attribute of the <sessionState> element specifies the connection string for SQL Server when using SQLServer session state mode?

   • AsqlConnectionString
   • BstateConnectionString
   • CconnectionString
   • DsessionDbConnection
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security audit reveals that an ASP.NET application is vulnerable to session hijacking because the session ID is predictable. The application uses default session state configuration. Which combination of changes would most effectively address this vulnerability?

   • AUse InProc session state mode and rely on the server's random number generator.
   • BSet the session cookie to Secure and HttpOnly, and use a custom random session ID generator.
   • CSwitch to cookieless session state and use a longer session ID.
   • DSet regenerateExpiredSessionId to true and increase the session timeout.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An ASP.NET application has a logout button that calls Session.Abandon(). However, after logout, users can still access protected pages by pressing the browser's back button. What is the most effective way to prevent this?

   • ACall Session.Clear() after Session.Abandon().
   • BRedirect the user to a logout confirmation page.
   • CAdd cache-control headers to the protected pages to prevent caching.
   • DSet the session cookie to expire immediately by using Response.Cookies["ASP.NET_SessionId"].Expires = DateTime.Now.AddDays(-1);
   Reveal Solution Discussion Select an answer first