A financial services company is concerned about session hijacking. They want to ensure that the session ID is not transmitted over unencrypted channels and that the session cookie is not accessible to client-side scripts. Which configuration should they implement in the ASP.NET application?

Set regenerateExpiredSessionId="true" and keep the default cookie settings

Set the session timeout to 5 minutes and use InProc mode

Set cookieless="UseUri" and enable SSL on the login page only

Set httpOnlyCookies="true" and requireCookies="true" in the httpCookies element, and enforce HTTPS on the site

A government agency runs an ASP.NET application that handles classified data. The security policy requires that session data be encrypted both in transit and at rest. The application currently uses SQLServer session state mode. Which additional configuration is required to meet the policy?

Enable SSL on the web server and set requireSSL="true" for cookies.

Use StateServer mode and enable encryption on the state connection.

Set the session mode to InProc and rely on the server's memory encryption.

Use a custom session state provider that encrypts session data before storing it in SQL Server.

What is a primary security disadvantage of using cookieless session state in ASP.NET?

Session IDs are automatically regenerated on every request

Session IDs are more likely to be exposed in URLs, increasing the risk of session hijacking

Session state cannot be used with HTTPS

Session data is stored in plain text on the server

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 1

ASP.NET Session Management Techniques CASENET Practice Questions (Page 4)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 16–20

16application · medium
A financial services company is concerned about session hijacking. They want to ensure that the session ID is not transmitted over unencrypted channels and that the session cookie is not accessible to client-side scripts. Which configuration should they implement in the ASP.NET application?
Select an answer first
17foundation · easy
In a load-balanced web farm, which session state mode ensures that session data is stored in a central database accessible by all web servers?
Select an answer first
18expert · hard
A government agency runs an ASP.NET application that handles classified data. The security policy requires that session data be encrypted both in transit and at rest. The application currently uses SQLServer session state mode. Which additional configuration is required to meet the policy?
Select an answer first
19foundation · easy
What is a primary security disadvantage of using cookieless session state in ASP.NET?
Select an answer first
20expert · hard
An ASP.NET application is deployed in a web farm. The IT team wants to ensure that session IDs are not exposed in the URL and that the session cookie is protected. They also want to prevent session fixation. Which web.config configuration would best meet these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

ASP.NET Session Management Techniques CASENET Practice Questions (Page 4)

Questions 16–20

A financial services company is concerned about session hijacking. They want to ensure that the session ID is not transmitted over unencrypted channels and that the session cookie is not accessible to client-side scripts. Which configuration should they implement in the ASP.NET application?

In a load-balanced web farm, which session state mode ensures that session data is stored in a central database accessible by all web servers?

A government agency runs an ASP.NET application that handles classified data. The security policy requires that session data be encrypted both in transit and at rest. The application currently uses SQLServer session state mode. Which additional configuration is required to meet the policy?

What is a primary security disadvantage of using cookieless session state in ASP.NET?

An ASP.NET application is deployed in a web farm. The IT team wants to ensure that session IDs are not exposed in the URL and that the session cookie is protected. They also want to prevent session fixation. Which web.config configuration would best meet these requirements?

Keep studying — Secure Coding: Session Management