Defensive Coding Against Broken Session Management CASENET Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A .NET application is deployed on multiple subdomains (e.g., `app.example.com` and `admin.example.com`). The session cookie is currently set with `Domain=example.com` and `SameSite=Lax`. A security review recommends adding `SameSite=Strict` to prevent CSRF. However, the admin subdomain needs to make cross-subdomain requests to the app subdomain. What is the best configuration?

   • ASet `SameSite=Strict` on the session cookie and use a different domain for the admin subdomain.
   • BSet `SameSite=None` and `Secure` on the session cookie.
   • CSet `SameSite=Lax` on the session cookie and use a separate cookie for the admin subdomain.
   • DSet `SameSite=Strict` on the session cookie and keep `Domain=example.com`.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A .NET application sets its session cookie with the following code: `Response.Cookies.Append("SessionID", sessionId, new CookieOptions { HttpOnly = true, Secure = true });` The application is deployed behind a load balancer that terminates TLS, and the cookie is not being sent over HTTPS from the client. What is the most likely cause?

   • AThe load balancer is not forwarding the original scheme to the application, so the application does not see the request as HTTPS.
   • BThe browser is configured to block all cookies from the application's domain.
   • CThe HttpOnly flag prevents the cookie from being transmitted over HTTPS.
   • DThe cookie name 'SessionID' is reserved and cannot be used with the Secure attribute.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A .NET application has a requirement that sessions must expire after 15 minutes of inactivity, but users are complaining that they are being logged out while filling out long forms. The team wants to extend the session without weakening security. Which approach is most appropriate?

   • AImplement a sliding expiration that resets the timeout on each request, and use JavaScript to warn users before the session expires.
   • BDisable the idle timeout and rely on the absolute timeout of 8 hours.
   • CIncrease the idle timeout to 60 minutes for all users.
   • DUse a client-side timer to automatically refresh the session every 10 minutes.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A .NET Core application is configured to use cookie-based sessions. The application is accessible via both HTTP and HTTPS. The security team requires that session cookies are never transmitted over unencrypted connections. Which configuration should be applied?

   • AStore the session ID in a custom header instead of a cookie.
   • BSet `Cookie.SecurePolicy = CookieSecurePolicy.Always` and redirect HTTP requests to HTTPS.
   • CSet `Cookie.SameSite = SameSiteMode.Strict`.
   • DSet `Cookie.HttpOnly = true` and leave the SecurePolicy as default.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why should session IDs never be placed in the URL query string?

   • ABecause URLs are often logged by web servers and proxies
   • BBecause URLs are limited in length
   • CBecause URLs are cached by the browser
   • DBecause URLs are encrypted by HTTPS
   Reveal Solution Discussion Select an answer first