Cookie-Based Session Management CASENET Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An ASP.NET application allows users to log in from a public Wi-Fi network. The security team requires that the session cookie be transmitted only over HTTPS and that the browser not send the cookie on cross-site requests. Which two cookie attributes should be set?

   • ASameSite=Lax and Secure
   • BSecure and SameSite=Strict
   • CHttpOnly and SameSite=Strict
   • DHttpOnly and Secure
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An ASP.NET application sets a session cookie with the following attributes: HttpOnly, Secure, SameSite=Lax, and Path=/. The application is served from https://shop.example.com. A user navigates from an external site to https://shop.example.com via a top-level GET link. Will the session cookie be sent with that request?

   • ANo, because the cookie's Path=/ restricts it to the root path only.
   • BYes, because Secure allows the cookie to be sent on any HTTPS request.
   • CYes, because SameSite=Lax allows the cookie on top-level cross-site GET navigations.
   • DNo, because SameSite=Lax blocks all cross-site requests.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of a CSRF token?

   • ATo ensure that a request originated from the legitimate user's browser and not a malicious site
   • BTo encrypt the session cookie
   • CTo prevent cross-site scripting attacks
   • DTo replace the need for session authentication
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An ASP.NET application is vulnerable to a stored XSS flaw that allows an attacker to inject script into pages. The session cookie currently lacks the HttpOnly attribute. Which mitigation should be applied to reduce the risk of session cookie theft via the XSS flaw?

   • ASet the Secure attribute on the session cookie.
   • BStore the session ID in a JavaScript variable instead of a cookie.
   • CSet the HttpOnly attribute on the session cookie.
   • DSet the SameSite attribute to Strict on the session cookie.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A developer is reviewing a custom session ID generator that uses a 64-bit integer derived from the current timestamp and a random seed from Random(). A security consultant says the IDs are predictable. Which replacement should be used?

   • AUse a GUID with the timestamp appended.
   • BUse Random.Next() but seed it with a cryptographic random number.
   • CUse a SHA-256 hash of the user's IP address and User-Agent.
   • DGenerate 256 bits using RandomNumberGenerator.GetBytes() and encode with Base64Url.
   Reveal Solution Discussion Select an answer first