Session Hijacking CEH Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A network security engineer is designing defenses against TCP session hijacking. The organization has a mix of legacy systems that do not support encryption and modern systems that do. Which control is the most effective at preventing off-path TCP session hijacking?

   • ARestricting access to the network segment
   • BDeploying network intrusion detection systems (IDS)
   • CImplementing IPsec or TLS for all traffic
   • DUsing random TCP sequence numbers
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A SOC analyst is reviewing logs and notices that a user's session ID was used from two different geographic locations within 5 minutes. The user is a remote employee who travels frequently. The analyst must decide whether this is a hijacking attempt or a false positive. Which additional data point would most help the analyst make this determination?

   • AThe user's department and manager approval
   • BThe server's load and response time
   • CThe user's login history and password change frequency
   • DThe user's browser User-Agent string and device fingerprint
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A penetration tester is conducting a session hijacking test against a web application that uses a session cookie. The tester has successfully captured a valid session cookie using a network sniffer. The tester wants to use the cookie to access the application as the victim. Which tool would be most appropriate to replay the cookie?

   • ABurp Suite's Repeater or a browser extension like EditThisCookie
   • BNmap to send HTTP requests with the stolen cookie
   • CMetasploit to exploit the session
   • DWireshark to inject the cookie into the network traffic
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A penetration tester is attempting to hijack a session by predicting the session ID. The application uses a session ID that is generated using a linear congruential generator (LCG). Which attack is the tester most likely to use?

   • ASession ID prediction
   • BSession fixation
   • CTCP sequence prediction
   • DCross-site scripting (XSS)
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Why is session hijacking considered a serious threat to web application security?

   • AIt encrypts the victim's session traffic, making it unreadable to the server
   • BIt permanently deletes the victim's account data from the server
   • CIt allows an attacker to bypass authentication and perform actions as the victim
   • DIt exploits vulnerabilities in the operating system to gain root access
   Reveal Solution Discussion Select an answer first