Which of the following is a recommended measure to prevent session hijacking in an ASP.NET application?

Storing the session ID in a hidden form field

Increasing the session timeout to 24 hours

Using the session ID in the URL for all requests

Transmitting session cookies only over HTTPS

A security audit reveals that the session cookie is not marked as Secure. The application is served over HTTPS. What is the risk of not setting the Secure flag?

The cookie will be stored in the browser's local storage

The cookie will expire sooner than expected

The cookie could be transmitted over an unencrypted HTTP connection if the user visits a non-HTTPS page on the same domain

The cookie can be read by JavaScript, leading to XSS attacks

Which practice is recommended to optimize ASP.NET session state performance?

Store large objects such as DataSets in session state for quick access

Disable session state for all pages to improve performance

Store only essential data in session state

Use InProc mode for all applications regardless of web farm requirements

What is a key requirement for using StateServer session state mode in a web farm?

The session state database must be created using aspnet_regsql.exe

All web servers must run the same version of Windows

Client affinity must be enabled on the load balancer

The ASP.NET state service must be running on a server accessible to all web servers

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 1

ASP.NET Session Management Techniques CASENET Practice Questions (Page 5)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 21–25

21foundation · easy
Which of the following is a recommended measure to prevent session hijacking in an ASP.NET application?
Select an answer first
22foundation · easy
Which event in the Global.asax file is raised when a session is abandoned or expires?
Select an answer first
23application · medium
A security audit reveals that the session cookie is not marked as Secure. The application is served over HTTPS. What is the risk of not setting the Secure flag?
Select an answer first
24foundation · easy
Which practice is recommended to optimize ASP.NET session state performance?
Select an answer first
25foundation · easy
What is a key requirement for using StateServer session state mode in a web farm?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.