An ASP.NET application stores the user's role and tenant ID in a cookie. The application uses the Data Protection API to encrypt and sign the cookie. A developer proposes adding the user's IP address to the cookie to prevent session hijacking. What is the primary drawback of this approach?

The IP address is not available in ASP.NET Core

The IP address is not encrypted by the Data Protection API

The IP address is not included in the cookie's signature

The IP address changes frequently for mobile users, causing legitimate sessions to be invalidated

Which ASP.NET feature automatically generates and validates CSRF tokens for form submissions?

ValidateAntiForgeryToken attribute

A developer is configuring session state for a new ASP.NET application. The security policy requires that session IDs be unpredictable and unique. The application will run on a single web server. Which session state configuration should the developer choose?

Use the user's email address as the session ID

Use a sequential integer counter for session IDs

Use InProc session state with the default session ID generator

Use a custom session ID generator based on the current timestamp

A banking ASP.NET application requires a 10-minute idle timeout for high-risk operations, but users complain they are logged out while filling out long forms. The product owner wants to extend the timeout to 30 minutes. The security team warns that a longer timeout increases the hijacking window. Which solution best addresses both concerns?

Set a fixed expiration of 30 minutes from login.

Increase the session timeout to 30 minutes and rely on HTTPS to protect the cookie.

Implement a sliding expiration of 30 minutes, but require re-authentication for sensitive actions after 10 minutes of inactivity.

Set the session cookie's SameSite attribute to Strict.

An ASP.NET application is configured with in-process session state. The operations team plans to deploy multiple instances behind a load balancer with sticky sessions disabled. Users report that they are randomly logged out. Which change should be made to the session state configuration?

Increase the sessionState timeout to 60 minutes.

Set the session cookie's Domain attribute to the load balancer's domain.

Switch to SQL Server or Redis session state provider.

Enable sticky sessions on the load balancer.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 2

Cookie-Based Session Management CASENET Practice Questions (Page 7)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 31–35

31expert · hard
An ASP.NET application stores the user's role and tenant ID in a cookie. The application uses the Data Protection API to encrypt and sign the cookie. A developer proposes adding the user's IP address to the cookie to prevent session hijacking. What is the primary drawback of this approach?
Select an answer first
32foundation · easy
Which ASP.NET feature automatically generates and validates CSRF tokens for form submissions?
Select an answer first
33application · medium
A developer is configuring session state for a new ASP.NET application. The security policy requires that session IDs be unpredictable and unique. The application will run on a single web server. Which session state configuration should the developer choose?
Select an answer first
34expert · hard
A banking ASP.NET application requires a 10-minute idle timeout for high-risk operations, but users complain they are logged out while filling out long forms. The product owner wants to extend the timeout to 30 minutes. The security team warns that a longer timeout increases the hijacking window. Which solution best addresses both concerns?
Select an answer first
35application · medium
An ASP.NET application is configured with in-process session state. The operations team plans to deploy multiple instances behind a load balancer with sticky sessions disabled. Users report that they are randomly logged out. Which change should be made to the session state configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.