A financial services company requires that user sessions expire after 10 minutes of inactivity. The .NET application is configured with `IdleTimeout = TimeSpan.FromMinutes(20)`. What should be done to meet the requirement?

Set `IdleTimeout` to `TimeSpan.FromMinutes(5)` to be safe.

Change `IdleTimeout` to `TimeSpan.FromMinutes(10)`.

Use `Session.Timeout = 10` in the web.config file.

Set `IdleTimeout` to `TimeSpan.FromMinutes(20)` and add a JavaScript timer to log the user out after 10 minutes.

A .NET web application's logout button currently only calls `HttpContext.Session.Clear()`. A security review notes that after logout, a user can press the browser back button and still access cached pages. Which additional action should be taken to properly invalidate the session?

Set the session cookie's Expires property to a date one year in the future.

Redirect the user to the login page without clearing any data.

Use `Response.Redirect` to the home page after clearing the session.

Call `HttpContext.Session.Abandon()` and remove the session cookie.

An ASP.NET Core application uses the default in-memory session. The operations team wants to deploy multiple instances behind a load balancer and also wants to enforce a 15-minute idle timeout. What should the developer configure?

Use `AddDistributedMemoryCache` and set `SessionOptions.IdleTimeout` to 15 minutes.

Use `AddStackExchangeRedisCache` and set `SessionOptions.Cookie.MaxAge` to 15 minutes.

Use `AddDistributedMemoryCache` and set `SessionOptions.Cookie.HttpOnly` to true.

Use `AddDistributedSqlServerCache` and set `SessionOptions.IdleTimeout` to 15 minutes.

A .NET application uses a distributed cache (Redis) for session storage. The logout method currently calls `HttpContext.Session.Clear()` and then deletes the session cookie. A security audit finds that the session data remains in Redis until the cache entry expires. Which additional step is necessary to fully invalidate the session?

Set the Redis cache entry's expiration to 1 minute.

Overwrite the session data with empty values before clearing.

Call `HttpContext.Session.Abandon()` instead of `Clear()`.

Remove the session entry from Redis using the session ID as the key.

Why is it important to clear the session cookie on the client side during logout?

To prevent the browser from sending the session ID in future requests

To prevent the session ID from being logged

To make the session ID invalid on the server

To prevent the session ID from being guessed

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 4

Defensive Coding Against Broken Session Management CASENET Practice Questions (Page 5)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

10concepts

10 Concepts in This Objective

Session Management Fundamentals
Secure Session ID Generation
Session ID Transmission Protection
Session ID Storage and Handling
Session Expiration and Timeout
Session Fixation Defense
Session Hijacking Mitigation
Secure Cookie Attributes
Session Logout and Invalidation
Session Management in .NET

Questions 21–25

21application · medium
A financial services company requires that user sessions expire after 10 minutes of inactivity. The .NET application is configured with `IdleTimeout = TimeSpan.FromMinutes(20)`. What should be done to meet the requirement?
Select an answer first
22application · medium
A .NET web application's logout button currently only calls `HttpContext.Session.Clear()`. A security review notes that after logout, a user can press the browser back button and still access cached pages. Which additional action should be taken to properly invalidate the session?
Select an answer first
23application · medium
An ASP.NET Core application uses the default in-memory session. The operations team wants to deploy multiple instances behind a load balancer and also wants to enforce a 15-minute idle timeout. What should the developer configure?
Select an answer first
24expert · hard
A .NET application uses a distributed cache (Redis) for session storage. The logout method currently calls `HttpContext.Session.Clear()` and then deletes the session cookie. A security audit finds that the session data remains in Redis until the cache entry expires. Which additional step is necessary to fully invalidate the session?
Select an answer first
25foundation · easy
Why is it important to clear the session cookie on the client side during logout?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.