A web application currently uses HTTP and sets session cookies without the Secure or HttpOnly flags. The development team wants to reduce the risk of session hijacking. Which combination of changes is most effective?

Disable cookies and use URL-based session IDs

Enable HTTPS and set the Secure and HttpOnly flags on session cookies

Implement IP-based session binding

Use longer session tokens and implement a session timeout

What is session fixation?

An attack that uses XSS to steal cookies

An attack where the attacker forces a user to use a known session ID

An attack that fixes the user's IP address to a session

An attack that freezes the session to prevent logout

A user reports that after logging into a banking website on a public Wi-Fi network, an attacker is able to access the user's account without knowing the password. The attacker likely stole the session cookie. Which countermeasure would be most effective to prevent this?

Disabling JavaScript in the browser

Using HTTPS for all communication

How can cross-site scripting (XSS) be used to perform session hijacking?

By predicting the TCP sequence numbers

By injecting malicious scripts that steal the user's session cookie

By flooding the server with requests to exhaust its resources

EC-CouncilCertified Security Specialist

Domain 4Objective 1

Network-Level Attacks (sniffing, DoS/DDoS, Session Hijacking) ECSS Practice Questions (Page 2)

Part of the Ethical Hacking Advanced Attacks and Penetration Testing domain, which makes up ~17% of our current practice bank.

51questions here

11free pages

12concepts

12 Concepts in This Objective

Network Sniffing Fundamentals
Passive vs. Active Sniffing
ARP Spoofing and Poisoning
MAC Flooding
DNS Spoofing and Cache Poisoning
DoS Attack Types
DDoS Attack Architecture
DoS/DDoS Mitigation Techniques
Session Hijacking Concepts
TCP/IP Session Hijacking
Application-Level Session Hijacking
Session Hijacking Countermeasures

Questions 6–10

6application · medium
A web application currently uses HTTP and sets session cookies without the Secure or HttpOnly flags. The development team wants to reduce the risk of session hijacking. Which combination of changes is most effective?
Select an answer first
7foundation · easy
Which of the following is a widely used open-source network sniffing tool that provides a graphical interface for packet capture and analysis?
Select an answer first
8foundation · easy
What is session fixation?
Select an answer first
9application · medium
A user reports that after logging into a banking website on a public Wi-Fi network, an attacker is able to access the user's account without knowing the password. The attacker likely stole the session cookie. Which countermeasure would be most effective to prevent this?
Select an answer first
10foundation · easy
How can cross-site scripting (XSS) be used to perform session hijacking?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.