What is the primary defense against session fixation attacks?

Setting the Secure cookie attribute

Regenerating the session ID after successful authentication

What is the correct way to invalidate a session on the server side during logout?

Redirect the user to the login page

Call the session's Abandon() or Clear() method

Set the session timeout to zero

Clear the session cookie on the client

A financial application in ASP.NET Core uses cookie authentication. The security team wants to reduce the risk of session hijacking if a session cookie is stolen. They consider binding the session to the user's IP address. What is the most appropriate approach?

Set the cookie's `SameSite` attribute to `Strict`.

Enable HTTPS redirection and set `Cookie.SecurePolicy` to `Always`.

Use a custom `ITicketStore` that stores the authentication ticket server-side and issues a random session ID.

Store the user's IP address in the session and validate it on every request, rejecting mismatches.

In a session fixation attack, what does the attacker typically do?

Inject malicious script to read the session cookie

Steal the victim's session ID from the network

Guess the victim's session ID through brute force

Set a known session ID in the victim's browser before authentication

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 4

Defensive Coding Against Broken Session Management CASENET Practice Questions (Page 2)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

10concepts

Questions 6–10

6foundation · easy
What is the primary defense against session fixation attacks?
Select an answer first
7foundation · easy
What is the correct way to invalidate a session on the server side during logout?
Select an answer first
8application · medium
A financial application in ASP.NET Core uses cookie authentication. The security team wants to reduce the risk of session hijacking if a session cookie is stolen. They consider binding the session to the user's IP address. What is the most appropriate approach?
Select an answer first
9foundation · easy
Which cookie attribute ensures that a session cookie is only sent over HTTPS connections?
Select an answer first
10foundation · easy
In a session fixation attack, what does the attacker typically do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.