Session Fixation WAHS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security audit reveals that a web application is vulnerable to session fixation. The application uses cookies for session management and does not regenerate session IDs after login. Which set of best practices should be implemented to mitigate this vulnerability?

   • ARegenerate the session ID after login, reject session IDs from query strings, and set the cookie's Secure and HttpOnly flags
   • BUse a longer session ID and increase the session timeout
   • CDisable cookies and use HTTP Basic authentication
   • DStore the session ID in a hidden form field and validate it on the server
   Reveal Solution Discussion Select an answer first
2. 2application · hard

   A security team is hardening a web application against session fixation. They plan to bind the session to the user's IP address and user agent, and to reject session IDs that do not match. Which additional control is still necessary to fully mitigate session fixation?

   • ALog all session ID changes for auditing.
   • BUse a longer session ID (e.g., 256 bits).
   • CRegenerate the session ID after authentication.
   • DSet the session cookie's Domain attribute to the exact hostname.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A web application serves users behind a corporate proxy that changes the apparent IP address for each request due to load balancing. The security team wants to add session binding to mitigate session fixation, but they are concerned about breaking legitimate users. Which binding attribute would be MOST reliable in this environment?

   • AUser agent string
   • BX-Forwarded-For header
   • CAccept-Language header
   • DSource IP address
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A QA tester is asked to verify whether a web application is vulnerable to session fixation. The tester has a valid account and can use a browser. Which testing approach would MOST reliably confirm the vulnerability?

   • AObtain a valid session ID before login, log in with that session ID, and then check whether the session ID changes after authentication
   • BSend multiple login requests with different passwords and observe whether the session ID changes
   • CLog in normally and then check whether the session cookie has the Secure and HttpOnly flags set
   • DUse an automated scanner to check for SQL injection in the login form
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of regenerating the session ID after a user authenticates?

   • ATo ensure the session ID is not stored in the browser history.
   • BTo allow the user to have multiple concurrent sessions.
   • CTo make the session ID longer and more random.
   • DTo prevent session fixation by invalidating any session ID that was set before login.
   Reveal Solution Discussion Select an answer first