A developer is explaining cookie behavior to a junior team member. The application sets a session cookie without an Expires or Max-Age attribute. The junior asks whether the cookie will persist after the browser is closed. Which statement is correct?

The cookie persists until the user clears browser history

The cookie persists until the server restarts

The cookie persists for 24 hours by default

The cookie is a session cookie and is deleted when the browser is closed

An ASP.NET MVC application uses cookie authentication. A security audit warns that the site is vulnerable to CSRF because state-changing requests (e.g., POST to /account/changeEmail) are not protected. Which defense should be implemented?

Check the Referer header on every POST request.

Add an anti-forgery token to the form and validate it with [ValidateAntiForgeryToken] on the action.

Set the session cookie's HttpOnly attribute to true.

Set the session cookie's Secure attribute to true.

What is the purpose of an idle session timeout?

To automatically log out users after a fixed period regardless of activity

To renew the session ID periodically

To terminate a session after a period of inactivity

To keep the session alive as long as the browser is open

An ASP.NET application uses cookie-based sessions. After login, the developer calls Session.Abandon() and then immediately creates a new session. However, a penetration test still shows that the original session ID is accepted after login. What is the most likely reason?

The session cookie lacks the Secure attribute.

The sessionState mode is set to InProc, which prevents regeneration.

The new session ID is generated but the old cookie is not cleared, so the browser continues to send the old ID.

The session cookie lacks the HttpOnly attribute.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 2

Cookie-Based Session Management CASENET Practice Questions (Page 8)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 36–40

36application · easy
A developer is explaining cookie behavior to a junior team member. The application sets a session cookie without an Expires or Max-Age attribute. The junior asks whether the cookie will persist after the browser is closed. Which statement is correct?
Select an answer first
37application · medium
An ASP.NET MVC application uses cookie authentication. A security audit warns that the site is vulnerable to CSRF because state-changing requests (e.g., POST to /account/changeEmail) are not protected. Which defense should be implemented?
Select an answer first
38foundation · easy
What is the purpose of an idle session timeout?
Select an answer first
39expert · hard
An ASP.NET application uses cookie-based sessions. After login, the developer calls Session.Abandon() and then immediately creates a new session. However, a penetration test still shows that the original session ID is accepted after login. What is the most likely reason?
Select an answer first
40foundation · easy
Which cookie attribute is essential to prevent client-side scripts from accessing the session cookie, thus protecting against XSS-based theft?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.