A healthcare organization runs an ASP.NET application that stores patient data in session state. The security policy requires that session data be protected from unauthorized access if the server's memory is compromised. Which configuration should be applied?

Use SQLServer session state mode and encrypt the session data using the aspnet_regiis tool.

Set session mode to InProc and rely on the operating system's memory protection.

Implement a custom session state provider that encrypts data before storing it.

Set the session cookie to Secure and HttpOnly.

What is the primary purpose of the regenerateExpiredSessionId attribute in the configuration?

To automatically extend the session timeout whenever a request is made

To prevent session fixation by generating a new session ID when an expired session ID is used

To encrypt the session ID before it is transmitted to the client

To store the session ID in a database for later retrieval

Why does using out-of-process session state modes (StateServer or SQLServer) introduce serialization overhead compared to InProc?

Because out-of-process modes use a slower garbage collector

Because session data is compressed before storage

Because session data is encrypted by default in out-of-process modes

Because session data must be serialized before being stored outside the application process

A security audit of an ASP.NET application found that session IDs are being transmitted over HTTP, and the application is vulnerable to session hijacking. The application is deployed behind a load balancer that handles SSL termination. Which configuration change would most effectively protect the session ID in transit?

Set httpOnlyCookies="true" in the element.

Set requireSSL="true" in the element.

Set cookieless="true" in the element.

Set regenerateExpiredSessionId="true" in the element.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 1

ASP.NET Session Management Techniques CASENET Practice Questions (Page 6)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 26–30

26application · medium
A healthcare organization runs an ASP.NET application that stores patient data in session state. The security policy requires that session data be protected from unauthorized access if the server's memory is compromised. Which configuration should be applied?
Select an answer first
27foundation · easy
What is the primary purpose of the regenerateExpiredSessionId attribute in the <sessionState> configuration?
Select an answer first
28foundation · easy
Why does using out-of-process session state modes (StateServer or SQLServer) introduce serialization overhead compared to InProc?
Select an answer first
29expert · hard
A security audit of an ASP.NET application found that session IDs are being transmitted over HTTP, and the application is vulnerable to session hijacking. The application is deployed behind a load balancer that handles SSL termination. Which configuration change would most effectively protect the session ID in transit?
Select an answer first
30foundation · easy
Which method of the HttpSessionState class is used to abandon the current session and release all session data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

ASP.NET Session Management Techniques CASENET Practice Questions (Page 6)

Questions 26–30

A healthcare organization runs an ASP.NET application that stores patient data in session state. The security policy requires that session data be protected from unauthorized access if the server's memory is compromised. Which configuration should be applied?

What is the primary purpose of the regenerateExpiredSessionId attribute in the <sessionState> configuration?

Why does using out-of-process session state modes (StateServer or SQLServer) introduce serialization overhead compared to InProc?

Which method of the HttpSessionState class is used to abandon the current session and release all session data?

Keep studying — Secure Coding: Session Management