An application has a session timeout of 20 minutes. A user logs in, uses the application for 10 minutes, and then leaves the computer unattended for 25 minutes. When they return and click a link, what happens?

The session is still active because the timeout is reset on every request

The session expires, but the user is automatically authenticated with a new session

The session remains active because the timeout only applies to idle periods after the first request

The session expires, and the user is redirected to the login page

A security consultant is reviewing an ASP.NET application that uses cookieless session state. The application is served over HTTPS. The consultant finds that the session ID appears in the URL and is also stored in the browser's history. Which additional control would most effectively reduce the risk of session hijacking via URL leakage?

Set the session timeout to 2 minutes

Switch to cookie-based session state with the Secure and HttpOnly flags

Enable regenerateExpiredSessionId="true"

Use a custom session ID validation that checks the user agent on every request

A company is deploying an ASP.NET application to a web farm. They need session state to be consistent across servers and survive server failures. They also want to minimize the cost of additional infrastructure. Which session state mode is the most cost-effective choice?

Custom mode with a free open-source cache

SQLServer using an existing database server

A public-facing ASP.NET application must support users who disable cookies in their browsers. The development team decides to use cookieless session state. What additional security measure should be implemented to reduce the risk of session hijacking?

Implement a short session timeout and regenerate the session ID when the user authenticates.

Disable the use of session state for anonymous users.

Use a longer session timeout to give users more time to complete their tasks.

Encrypt the session ID in the URL using a custom algorithm.

An ASP.NET application is deployed behind a load balancer that terminates SSL. The application uses cookie-based session state. The security team wants to ensure that session cookies are not sent over unencrypted HTTP connections. What should be configured?

Set the regenerateExpiredSessionId attribute to true in the element.

Set the httpOnlyCookies attribute to true in the element.

Set the requireSSL attribute to true in the element.

Set the cookieless attribute to true in the element.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 1

ASP.NET Session Management Techniques CASENET Practice Questions (Page 3)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 11–15

11expert · medium
An application has a session timeout of 20 minutes. A user logs in, uses the application for 10 minutes, and then leaves the computer unattended for 25 minutes. When they return and click a link, what happens?
Select an answer first
12expert · hard
A security consultant is reviewing an ASP.NET application that uses cookieless session state. The application is served over HTTPS. The consultant finds that the session ID appears in the URL and is also stored in the browser's history. Which additional control would most effectively reduce the risk of session hijacking via URL leakage?
Select an answer first
13expert · hard
A company is deploying an ASP.NET application to a web farm. They need session state to be consistent across servers and survive server failures. They also want to minimize the cost of additional infrastructure. Which session state mode is the most cost-effective choice?
Select an answer first
14application · medium
A public-facing ASP.NET application must support users who disable cookies in their browsers. The development team decides to use cookieless session state. What additional security measure should be implemented to reduce the risk of session hijacking?
Select an answer first
15application · medium
An ASP.NET application is deployed behind a load balancer that terminates SSL. The application uses cookie-based session state. The security team wants to ensure that session cookies are not sent over unencrypted HTTP connections. What should be configured?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.