Session Fixation WAHS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security audit of a web application reveals that it accepts session IDs from query strings and does not regenerate session IDs after login. Which two changes should be prioritized to fix the session fixation vulnerability?

   • ASet the HttpOnly flag on the session cookie and use a longer session ID.
   • BStop accepting session IDs from query strings and regenerate the session ID after authentication.
   • CBind the session to the user's IP address and user agent.
   • DIncrease the session timeout and require re-authentication for sensitive actions.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why should a web application reject session IDs that are not recognized or are invalid?

   • ATo prevent attackers from using arbitrary or fixed session IDs.
   • BTo reduce the length of the session ID.
   • CTo ensure the session ID is stored in a cookie.
   • DTo make the session ID harder to guess.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a session fixation attack, how does the attacker typically set the victim's session identifier to a known value?

   • ABy using a cross-site scripting (XSS) vulnerability to read the victim's current session cookie.
   • BBy predicting the session ID based on the server's random number generator.
   • CBy sending the victim a link that contains a session ID in the URL query string.
   • DBy brute-forcing the session ID after the victim logs in.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How can binding a session ID to a user attribute, such as the IP address, help mitigate session fixation?

   • AIt prevents the session ID from being sent over HTTP.
   • BIt makes it harder for an attacker to use a fixed session ID from a different IP address.
   • CIt ensures the session ID is not stored in cookies.
   • DIt makes the session ID more random.
   Reveal Solution Discussion Select an answer first
6. 10application · easy

   A security analyst is explaining the difference between session fixation and session hijacking to a colleague. Which statement is accurate?

   • AIn session fixation, the attacker provides the session ID; in session hijacking, the attacker steals an existing session ID.
   • BSession fixation is a type of session hijacking that occurs after authentication.
   • CSession fixation requires the attacker to be on the same network as the victim; session hijacking does not.
   • DSession fixation only works with URL-based session IDs; session hijacking only works with cookies.
   Reveal Solution Discussion Select an answer first