A web application uses a session cookie that is not marked HttpOnly. An attacker exploits a cross-site scripting (XSS) vulnerability to steal the session cookie and then replays it to impersonate the victim. Which two controls would have prevented this attack?

Set the HttpOnly flag on the session cookie and implement input sanitization to prevent XSS

Implement multi-factor authentication and CAPTCHA

Use a short session timeout and rotate the session ID

What is forced browsing?

Using a browser extension to automate form filling

Using a proxy to hide the attacker's IP

Sending a large number of requests to overload the server

Guessing or enumerating URLs to access restricted pages directly

What makes a password reset token predictable?

The token is generated using a weak random number generator or based on predictable data like timestamps

The token expires after a short time

What is a hardcoded backdoor?

A tool used to test application security

A method to encrypt user passwords

A security feature that prevents unauthorized access

A hidden account or password embedded in the application code that allows unauthorized access

What is the primary goal of an authentication bypass attack?

To encrypt the communication channel between client and server

To overload the authentication server with requests

To gain access to protected resources without providing valid credentials

To steal a user's password through phishing

EC-CouncilWeb Application Hacking and Security

Domain 8Objective 1

Authentication Bypass WAHS Practice Questions (Page 2)

Part of the Authentication and Session Management domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~25–41 in this domain), expect 8–14 from this objective — we provide 75 practice questions to prepare you well beyond it. (estimate)

75questions here

15free pages

20concepts

20 Concepts in This Objective

Authentication Bypass Fundamentals
Direct URL Access and Parameter Manipulation
Session Token Prediction and Hijacking
SQL Injection in Authentication
Weak Password Recovery Mechanisms
Insecure Direct Object References (IDOR)
Forced Browsing and Privilege Escalation
Authentication Bypass via HTTP Methods
Cookie Manipulation and Replay Attacks
Multi-Factor Authentication (MFA) Bypass
Authentication Bypass via API Endpoints
Race Conditions in Authentication
Client-Side Authentication Bypass
Default Credentials and Hardcoded Backdoors
Authentication Bypass via Response Manipulation
Logout and Session Termination Flaws
Authentication Bypass via Error Messages
OAuth and Third-Party Authentication Bypass
Password Reset Token Prediction
Authentication Bypass via File Upload

Questions 6–10

6expert · hard
A web application uses a session cookie that is not marked HttpOnly. An attacker exploits a cross-site scripting (XSS) vulnerability to steal the session cookie and then replays it to impersonate the victim. Which two controls would have prevented this attack?
Select an answer first
7foundation · easy
What is forced browsing?
Select an answer first
8foundation · easy
What makes a password reset token predictable?
Select an answer first
9foundation · easy
What is a hardcoded backdoor?
Select an answer first
10foundation · easy
What is the primary goal of an authentication bypass attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.