An ASP.NET Core application uses cookie authentication and includes anti-forgery tokens in forms. The application is embedded in an iframe on a partner site, and the partner site needs to submit forms to the application. The developer sets SameSite=None on the authentication cookie and the anti-forgery cookie. However, CSRF attacks still succeed. Which additional configuration is required?

Validate the Origin header on all state-changing requests

Set the Secure attribute on both cookies

Remove the anti-forgery token validation

Set the SameSite attribute to Lax instead of None

An ASP.NET Core application allows users to change their email address via a form. The security team is concerned that an attacker could trick a logged-in user into submitting the form without their consent. The application already uses cookies for authentication. Which additional control should the developer implement?

Require the user to re-enter their password on every request

Store the session ID in the URL query string

Set the cookie's SameSite attribute to None

Include an anti-forgery token in the form and validate it on the server

Why should session cookies be stored only in memory (non-persistent) rather than on disk?

To reduce the risk of the cookie being stolen from the client's hard drive

To reduce network bandwidth usage

To make the cookie expire faster

To prevent the cookie from being sent to the server

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 2

Cookie-Based Session Management CASENET Practice Questions (Page 5)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 21–25

21expert · hard
An ASP.NET Core application uses cookie authentication and includes anti-forgery tokens in forms. The application is embedded in an iframe on a partner site, and the partner site needs to submit forms to the application. The developer sets SameSite=None on the authentication cookie and the anti-forgery cookie. However, CSRF attacks still succeed. Which additional configuration is required?
Select an answer first
22foundation · easy
Which cookie attribute prevents client-side scripts from accessing the cookie, thereby mitigating XSS-based cookie theft?
Select an answer first
23application · medium
An ASP.NET Core application allows users to change their email address via a form. The security team is concerned that an attacker could trick a logged-in user into submitting the form without their consent. The application already uses cookies for authentication. Which additional control should the developer implement?
Select an answer first
24foundation · easy
In ASP.NET Core, which method is used to configure cookie-based session services?
Select an answer first
25foundation · easy
Why should session cookies be stored only in memory (non-persistent) rather than on disk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Cookie-Based Session Management CASENET Practice Questions (Page 5)

Questions 21–25

Which cookie attribute prevents client-side scripts from accessing the cookie, thereby mitigating XSS-based cookie theft?

In ASP.NET Core, which method is used to configure cookie-based session services?

Why should session cookies be stored only in memory (non-persistent) rather than on disk?

Keep studying — Secure Coding: Session Management