A security architect is designing a defense-in-depth strategy for a web application that handles sensitive user data. The architect wants to implement multiple layers of protection against session hijacking. Which combination of controls is most effective?

Use HTTPS, set HttpOnly and Secure flags on cookies, and regenerate session IDs after login

Use a longer session ID and set a short session timeout

Use a web application firewall (WAF) and monitor logs for anomalies

Use IP-based session binding and a custom session ID header

A web application administrator is configuring session management to prevent session hijacking. The application is hosted on HTTPS and uses a session cookie. Which configuration provides the strongest protection against session theft?

Setting a long session timeout and using a complex session ID

Using a custom header for the session ID and disabling cookies

Setting the HttpOnly, Secure, and SameSite attributes on the session cookie

Rotating the session ID on every request

What is the primary purpose of a session ID in a web application?

To uniquely identify a user's session and maintain state across HTTP requests

To encrypt the communication between the client and server

To store the user's password in an encrypted format on the client

To provide a unique IP address for the client's connection

A security operations center (SOC) analyst is monitoring a web application and notices that a user's session ID is being used from two different IP addresses within a short time frame. The analyst suspects session hijacking. Which action should the analyst take first?

Enable two-factor authentication for the user

Send an alert to the user and wait for a response

Block the second IP address in the firewall

Invalidate the session and require the user to re-authenticate

How does cross-site scripting (XSS) enable session hijacking?

By predicting the session ID using statistical analysis

By intercepting the session ID through network sniffing

By injecting malicious scripts that steal the session cookie and send it to the attacker

By flooding the server with requests to exhaust session resources

EC-CouncilCertified Ethical Hacker

Domain 4Objective 4

Session Hijacking CEH Practice Questions (Page 6)

Part of the Network and Perimeter Hacking domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 26–30

26application · medium
A security architect is designing a defense-in-depth strategy for a web application that handles sensitive user data. The architect wants to implement multiple layers of protection against session hijacking. Which combination of controls is most effective?
Select an answer first
27application · medium
A web application administrator is configuring session management to prevent session hijacking. The application is hosted on HTTPS and uses a session cookie. Which configuration provides the strongest protection against session theft?
Select an answer first
28foundation · easy
What is the primary purpose of a session ID in a web application?
Select an answer first
29application · medium
A security operations center (SOC) analyst is monitoring a web application and notices that a user's session ID is being used from two different IP addresses within a short time frame. The analyst suspects session hijacking. Which action should the analyst take first?
Select an answer first
30foundation · easy
How does cross-site scripting (XSS) enable session hijacking?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.