Cookie-Based Session Management CASENET Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An ASP.NET Core application uses cookie authentication and has a controller action that accepts POST requests. The application is deployed in a microservices architecture where the frontend and backend are on different origins. The frontend sends requests with credentials. The security team wants to prevent CSRF without breaking legitimate cross-origin requests. Which configuration should be used?

   • AUse anti-forgery tokens and configure CORS to allow the frontend origin with credentials.
   • BDisable CORS and rely on the browser's same-origin policy.
   • CSet the session cookie's SameSite attribute to Strict.
   • DSet the session cookie's SameSite attribute to None and Secure.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An e-commerce site's security team noticed that users' sessions remain valid even when the browser's User-Agent string changes. An attacker who steals a session cookie can replay it from a different device. The team wants to reduce this risk without breaking legitimate users who upgrade their browsers. Which approach should the developer implement?

   • AEncrypt the session cookie with a key derived from the User-Agent
   • BSet the cookie's Domain attribute to the exact client IP address
   • CBind the session to the User-Agent string and reject any request where it differs
   • DStore the User-Agent hash in the session and flag the session for re-authentication if it changes
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial ASP.NET application is concerned about session hijacking. The security team wants to detect when a session cookie is used from a different browser or device than the one that authenticated. Which additional control should be implemented?

   • AEncrypt the session cookie with the server's private key.
   • BSet the session cookie's Expires attribute to a far-future date.
   • CStore a hash of the User-Agent string in the session and compare it on each request.
   • DSet the session cookie's SameSite attribute to Strict.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An ASP.NET application uses cookie-based sessions with a 20-minute idle timeout. The application is deployed in a web farm with multiple servers. The developer is configuring session state to ensure that a user's session remains valid when requests are load-balanced to different servers. Which session state configuration should the developer use?

   • ASet the cookie's Domain attribute to the load balancer's hostname
   • BUse SQL Server session state with a shared database
   • CUse InProc session state on each server
   • DUse a custom session ID generator based on the server name
   Reveal Solution Discussion Select an answer first
6. 15application · hard

   An ASP.NET application is deployed behind a load balancer that terminates TLS. The application's session cookie is currently set with Secure=true, but users report that they are logged out whenever they navigate from an HTTPS page to an HTTP page within the same site. The developer discovers that the load balancer forwards HTTP requests to the application. Which configuration change should the developer make?

   • ARemove the Secure attribute from the cookie
   • BConfigure the application to trust the X-Forwarded-Proto header and set the cookie's Secure flag based on the original request scheme
   • CSet the cookie's Domain attribute to the load balancer's IP address
   • DSet the cookie's SameSite attribute to None
   Reveal Solution Discussion Select an answer first