A .NET application's logout button currently calls `Session.Abandon()` and redirects to the login page. A security review notes that the session cookie remains in the browser and the server-side session state may not be immediately cleared. What should the developer add to the logout procedure?

Call `Session.Clear()` and then `Session.Abandon()`.

Redirect to a page that calls `Session.Abandon()` in the `Page_Load` event.

Set the session cookie's expiration date to a past date and call `Session.Abandon()`.

Call `Response.Cookies.Remove("ASP.NET_SessionId")` and then redirect.

An ASP.NET application currently stores the session ID in a cookie, but a developer notices that the session ID also appears in the URL for some pages. The application uses `SessionState` with `cookieless="UseUri"` in web.config. What is the best way to eliminate session IDs from URLs?

Set `cookieless="UseDeviceProfile"` to use cookies for most browsers.

Keep `cookieless="UseUri"` but add a URL rewrite rule to hide the session ID.

Set `cookieless="AutoDetect"` to let the browser decide.

Change `cookieless` to `UseCookies` and ensure the session cookie is set with `HttpOnly` and `Secure`.

A .NET web application uses cookie-based sessions. After a user successfully authenticates, the application continues to use the same session ID that was issued before login. A penetration test report flags this as a session fixation risk. Which change should be implemented?

Encrypt the session ID using a machine key before storing it in the cookie.

Bind the session to the user's IP address and user agent.

Set the session cookie's Expires property to a fixed date in the past.

Regenerate the session ID immediately after successful authentication.

Which .NET configuration setting controls the idle timeout for a session in ASP.NET Core?

AuthenticationOptions.ExpireTimeSpan

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 4

Defensive Coding Against Broken Session Management CASENET Practice Questions (Page 6)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

10concepts

Questions 26–30

26application · medium
A .NET application's logout button currently calls `Session.Abandon()` and redirects to the login page. A security review notes that the session cookie remains in the browser and the server-side session state may not be immediately cleared. What should the developer add to the logout procedure?
Select an answer first
27application · medium
An ASP.NET application currently stores the session ID in a cookie, but a developer notices that the session ID also appears in the URL for some pages. The application uses `SessionState` with `cookieless="UseUri"` in web.config. What is the best way to eliminate session IDs from URLs?
Select an answer first
28application · medium
A .NET web application uses cookie-based sessions. After a user successfully authenticates, the application continues to use the same session ID that was issued before login. A penetration test report flags this as a session fixation risk. Which change should be implemented?
Select an answer first
29foundation · easy
Which .NET configuration setting controls the idle timeout for a session in ASP.NET Core?
Select an answer first
30foundation · easy
Which cookie attribute prevents client-side JavaScript from accessing the session cookie?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.