What is the difference between an absolute session timeout and an idle timeout?

Absolute timeout expires the session after a fixed total duration; idle timeout expires after a period of inactivity

Absolute timeout is longer than idle timeout

Absolute timeout is used for authentication; idle timeout is used for authorization

Absolute timeout is enforced by the client; idle timeout is enforced by the server

What is the primary security benefit of implementing session expiration and timeout?

It reduces the window of opportunity for an attacker to use a stolen session ID

It makes the session ID harder to guess

It prevents the server from running out of memory

It ensures that users are always logged out after a fixed time

What is the primary purpose of session management in a web application?

To maintain state and identify a user across multiple HTTP requests

To provide a unique identifier for every HTTP request

To encrypt all data transmitted between the client and the server

To store user passwords securely on the server

Which of the following is a common session-related vulnerability that arises from using a predictable session identifier?

Session hijacking through ID guessing

SQL injection through unsanitized input

Denial of service through resource exhaustion

Cross-site scripting via unescaped output

Which technique can be used to mitigate session hijacking by binding a session to a specific client characteristic?

Setting a short session timeout

Binding the session to the user's IP address

Regenerating the session ID periodically

Storing the session ID in a cookie

EC-CouncilCertified Application Security Engineer (.NET)

Domain 6Objective 4

Defensive Coding Against Broken Session Management CASENET Practice Questions (Page 7)

Part of the Secure Coding: Session Management domain, which makes up ~10% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

10concepts

Questions 31–35

31foundation · easy
What is the difference between an absolute session timeout and an idle timeout?
Select an answer first
32foundation · easy
What is the primary security benefit of implementing session expiration and timeout?
Select an answer first
33foundation · easy
What is the primary purpose of session management in a web application?
Select an answer first
34foundation · easy
Which of the following is a common session-related vulnerability that arises from using a predictable session identifier?
Select an answer first
35foundation · easy
Which technique can be used to mitigate session hijacking by binding a session to a specific client characteristic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.