Cookie-Based Session Management CASENET Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   An ASP.NET application is being migrated from a single server to a load-balanced web farm. The application uses in-process session state. The team wants to minimize changes to the application code while ensuring sessions survive instance failures. Which session state provider should be selected?

   • ACustom session provider that stores sessions in the browser cookie.
   • BSQL Server session state with a dedicated database.
   • CIn-process session state with sticky sessions enabled on the load balancer.
   • DASP.NET State Service on a separate machine.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security analyst is investigating a potential session hijacking incident. The application uses cookie-based sessions with a 30-minute idle timeout. The analyst notices that a session remained active for 8 hours with continuous requests every 5 minutes from the same IP address. The user claims they were not using the application during that time. Which additional control would most effectively detect this type of hijacking?

   • ABind the session to the User-Agent string and reject mismatches
   • BShorten the idle timeout to 5 minutes
   • CImplement an absolute session timeout of 2 hours
   • DSet the cookie's SameSite attribute to Strict
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A developer is implementing login for an ASP.NET MVC application. The current code issues a session cookie before authentication and reuses the same session ID after the user logs in. A penetration test revealed that an attacker can set a known session ID in the victim's browser before login. Which code change should the developer make to mitigate this vulnerability?

   • ACall Session.Abandon() and then create a new session with a fresh ID after successful authentication
   • BSet the cookie's Expires attribute to a short duration
   • CAdd a hidden form field containing the session ID
   • DStore the session ID in a JavaScript variable instead of a cookie
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An ASP.NET application stores a serialized object in a cookie that contains the user's role and a timestamp. The application currently uses the machineKey to encrypt the cookie. A security review recommends adding integrity protection. The team is concerned about performance. Which approach should be used?

   • ABase64-encode the serialized object and append a CRC32 checksum.
   • BUse the DataProtection API (DPAPI) to encrypt the cookie.
   • CStore the role in a server-side session instead of the cookie.
   • DUse the machineKey with both encryption and validation enabled (e.g., validation=HMACSHA256).
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is considered a best practice for generating session IDs in .NET?

   • AUsing a random number generator seeded with the current timestamp
   • BUsing the client's IP address combined with a fixed salt
   • CUsing RNGCryptoServiceProvider or RandomNumberGenerator to create a random value
   • DUsing the user's username as the session ID
   Reveal Solution Discussion Select an answer first