Cookie-Based Session Management CASENET Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which ASP.NET configuration setting controls the session idle timeout?

   • Aauthentication forms timeout
   • BsessionState timeout
   • ChttpCookies httpOnlyCookies
   • Dcompilation debug
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following best describes the structure of a cookie?

   • AA header that is only sent by the server and never echoed back by the client
   • BA single text string that contains the entire session data
   • CA name-value pair with optional attributes such as Domain, Path, Expires, and Secure
   • DA binary file stored in the browser's cache that includes executable code
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An ASP.NET application stores the username and a role claim directly in the session cookie. A security review notes that users can modify the cookie and escalate privileges. Which approach should be used to protect the cookie's integrity?

   • ASet the cookie's Secure attribute to true.
   • BBase64-encode the cookie contents.
   • CSign the cookie with a keyed hash (HMAC) using a server-side secret.
   • DSet the cookie's HttpOnly attribute to true.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A financial application stores the user's account number and role directly in the session cookie. The security team requires that the cookie's contents remain confidential and that any tampering with the values be detected. The application runs on ASP.NET Core. Which configuration should the developer use?

   • ASet the cookie's Secure attribute and rely on HTTPS
   • BBase64-encode the cookie value and set HttpOnly=true
   • CUse the Data Protection API with Protect() to encrypt and sign the cookie data
   • DStore the account number in a separate cookie and the role in another
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is a key requirement for a secure session identifier?

   • AIt must be unpredictable and unique to prevent guessing or collision
   • BIt must be based on the user's IP address to ensure uniqueness
   • CIt must be a sequential number to simplify server-side lookup
   • DIt must be short and easy to remember for the user
   Reveal Solution Discussion Select an answer first