Defensive Coding Against Broken Session Management CASENET Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is it important to use a cryptographically secure random number generator (CSPRNG) for session ID generation?

   • ATo ensure the session ID is unique across all users
   • BTo reduce the length of the session ID
   • CTo make the session ID unpredictable to attackers
   • DTo allow the session ID to be stored in a cookie
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of the SameSite cookie attribute?

   • ATo prevent the cookie from being accessed by JavaScript
   • BTo set the cookie's expiration date
   • CTo prevent the cookie from being sent over HTTP
   • DTo control whether the cookie is sent in cross-site requests
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A .NET Core application is configured with cookie-based sessions. The application is accessible via both HTTP and HTTPS. The security team requires that session cookies are never transmitted over unencrypted connections. Which configuration should be applied?

   • ASet `Cookie.SameSite = SameSiteMode.Strict`.
   • BSet `Cookie.HttpOnly = true` and leave the SecurePolicy as default.
   • CStore the session ID in a custom header instead of a cookie.
   • DSet `Cookie.SecurePolicy = CookieSecurePolicy.Always` and redirect HTTP requests to HTTPS.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A .NET web application currently uses the default ASP.NET session ID generation. A security review flags that session IDs are predictable under high load. The team must harden session ID generation without changing the session state provider. Which change should the team implement?

   • ASet the `SessionStateSection.RegenerateExpiredSessionId` attribute to `true` in web.config.
   • BEnable `httpCookies requireSSL="true"` in web.config to force HTTPS for the session cookie.
   • CSet `sessionState mode="StateServer"` to offload session storage to a separate process.
   • DImplement a custom `ISessionIDManager` that uses `RNGCryptoServiceProvider` to create a 128-bit random ID and set the `SessionIDManager` in web.config.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An ASP.NET application currently stores the session ID in a hidden form field to support clients that disable cookies. A security audit flags this as a risk because the session ID appears in the HTML source and may be logged by proxy servers. What is the recommended remediation?

   • AContinue using the hidden field but encrypt it with the machine key.
   • BMove the session ID to a query string parameter.
   • CRequire cookies for session management and reject requests without a session cookie.
   • DUse a fixed session ID for all users to avoid generating new ones.
   Reveal Solution Discussion Select an answer first