What is the primary purpose of an HTTP cookie in the context of session management?

To permanently store user preferences on the server side

To maintain state across stateless HTTP requests by carrying a session identifier

To store the user's password securely on the client side

To encrypt all data transmitted between the client and the server

An online banking application currently keeps sessions active indefinitely as long as the browser is open. A security audit recommends limiting the window during which a stolen session cookie can be used. The application must also allow users to remain logged in while actively performing transactions. Which session expiration policy should the developer implement?

Set an absolute timeout of 30 minutes and an idle timeout of 10 minutes

Set the cookie's Max-Age attribute to 0

Set only an idle timeout of 30 minutes

Set the cookie's Expires attribute to 24 hours from login

Which of the following is an effective technique to mitigate session hijacking?

Transmitting session cookies only over HTTPS

Storing the session ID in a URL query string

Using a predictable session ID for easier validation

Disabling session timeouts to avoid user inconvenience

What is the primary purpose of encrypting session cookies?

To prevent the cookie from being sent over HTTP

To make the cookie expire automatically

To protect the confidentiality of the data stored in the cookie

To ensure the cookie cannot be modified by the client

What is the primary defense against session fixation attacks?

Setting the cookie's Secure attribute

Regenerating the session ID after authentication

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 2

Cookie-Based Session Management CASENET Practice Questions (Page 2)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 6–10

6foundation · easy
What is the primary purpose of an HTTP cookie in the context of session management?
Select an answer first
7application · medium
An online banking application currently keeps sessions active indefinitely as long as the browser is open. A security audit recommends limiting the window during which a stolen session cookie can be used. The application must also allow users to remain logged in while actively performing transactions. Which session expiration policy should the developer implement?
Select an answer first
8foundation · easy
Which of the following is an effective technique to mitigate session hijacking?
Select an answer first
9foundation · easy
What is the primary purpose of encrypting session cookies?
Select an answer first
10foundation · easy
What is the primary defense against session fixation attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.