Cookie-Based Session Management CASENET Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A developer is fixing a session fixation vulnerability in an ASP.NET application. The application uses cookie-based sessions and also issues a separate CSRF token that is stored in a second cookie. The developer plans to call Session.Abandon() and then create a new session after login. However, the CSRF token cookie is not regenerated. Which additional step is required to fully prevent session fixation?

   • ARegenerate the CSRF token cookie as well, because it is also a session identifier
   • BSet the CSRF token cookie's HttpOnly attribute to true
   • CSet the CSRF token cookie's SameSite attribute to Strict
   • DEncrypt the CSRF token cookie with a new key
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which cookie attribute restricts the browser from sending the cookie on cross-site requests, providing protection against CSRF?

   • ASameSite
   • BHttpOnly
   • CSecure
   • DDomain
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which ASP.NET session state mode stores session data in memory on the web server and is suitable for a single-server deployment?

   • ASQLServer
   • BCustom
   • CStateServer
   • DInProc
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In ASP.NET, which method is used to regenerate a session ID to prevent session fixation?

   • ASession.Clear()
   • BSession.RemoveAll()
   • CSessionIDManager.RegenerateSessionID()
   • DSession.Abandon()
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is it important to sign session cookies?

   • ATo prevent the user from reading the cookie contents
   • BTo detect if the cookie has been tampered with
   • CTo allow the cookie to be used across different domains
   • DTo make the cookie smaller in size
   Reveal Solution Discussion Select an answer first