ASP.NET Session Management Techniques CASENET Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An application allows users to log in and then access sensitive features. The security team wants to ensure that the session ID is not predictable and that it is changed after login. Which two measures should be implemented?

   • ACall Session.Abandon() and then create a new session after login, and rely on ASP.NET's random session ID generator
   • BStore the session ID in a hidden field and validate it on each request
   • CUse the default session ID generation and set a long timeout
   • DUse cookieless sessions and disable session timeout
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team is hardening an ASP.NET application. They want to protect session data from being read by an attacker who gains access to the server's memory. They also want to prevent session hijacking via network sniffing. Which combination of measures achieves both goals?

   • AUse Custom mode with a distributed cache and rely on network security
   • BUse StateServer mode and set httpOnlyCookies="true"
   • CUse InProc mode and enforce HTTPS
   • DUse SQLServer mode with encrypted session data and enforce HTTPS
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An ASP.NET application has a session timeout of 20 minutes. A user logs in, uses the application for 10 minutes, and then leaves the computer for 30 minutes. When the user returns and makes a request, what will happen?

   • AThe session will expire because the user was inactive for more than 20 minutes.
   • BThe session will still be active because the timeout is based on the total time since the session was created.
   • CThe session will be regenerated with a new session ID because the timeout expired.
   • DThe session will be abandoned because the user closed the browser.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a recommended approach to protect sensitive data stored in ASP.NET session state?

   • AEncrypt the session data before storing it in session state
   • BStore sensitive data in hidden form fields instead of session state
   • CUse a longer session timeout to keep data available
   • DDisable session state to avoid storing sensitive data
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An ASP.NET application allows users to log in and access their profile. The security team wants to prevent session fixation attacks. The application currently uses cookie-based session state and does not change the session ID after login. Which action should the developer take?

   • ACall Session.Clear() after the user is authenticated.
   • BCall Session.Abandon() and then create a new session by accessing Session.SessionID.
   • CSet Session.Timeout to a very low value after login.
   • DCall Session.Abandon() at the end of the login method.
   Reveal Solution Discussion Select an answer first