A security team is hardening a web application that has experienced session fixation attacks. They plan to regenerate the session ID after login, but they also want to add a defense-in-depth measure that makes it harder for an attacker to use a fixed session ID even if regeneration is bypassed. Which additional control would be MOST effective?

Bind the session to the user's IP address and user agent after authentication

Set the session cookie's SameSite attribute to Strict

Store the session ID in a JavaScript variable instead of a cookie

What is the core characteristic of a session fixation attack?

The attacker steals an already authenticated session identifier from the victim.

The attacker forces the victim to use a session identifier that the attacker already knows.

The attacker intercepts the session identifier during transmission over the network.

The attacker guesses the victim's session identifier after authentication.

A web application is being redesigned for better security. The team wants to implement secure session management from scratch. Which combination of controls should be included to specifically prevent session fixation?

Regenerate session ID after login, reject session IDs not issued by the server, and use HttpOnly cookies.

Use a fixed session ID for the entire user lifecycle to maintain state.

Use a long session timeout and store session data in a database.

Accept session IDs from both cookies and URL parameters for compatibility.

When should a web application regenerate the session ID to effectively mitigate session fixation?

Immediately after the user successfully authenticates.

Every time the user navigates to a new page.

After the victim authenticates in a session fixation attack, what does the attacker do to gain access?

The attacker intercepts the session cookie during the authentication request.

The attacker must brute-force the new session ID generated after login.

The attacker uses a different session ID that was also fixed earlier.

The attacker uses the same session ID that was fixed before authentication.

EC-CouncilWeb Application Hacking and Security

Domain 8Objective 2

Session Fixation WAHS Practice Questions (Page 5)

Part of the Authentication and Session Management domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~25–41 in this domain), expect 8–14 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

9concepts

Questions 21–25

21application · medium
A security team is hardening a web application that has experienced session fixation attacks. They plan to regenerate the session ID after login, but they also want to add a defense-in-depth measure that makes it harder for an attacker to use a fixed session ID even if regeneration is bypassed. Which additional control would be MOST effective?
Select an answer first
22foundation · easy
What is the core characteristic of a session fixation attack?
Select an answer first
23application · medium
A web application is being redesigned for better security. The team wants to implement secure session management from scratch. Which combination of controls should be included to specifically prevent session fixation?
Select an answer first
24foundation · easy
When should a web application regenerate the session ID to effectively mitigate session fixation?
Select an answer first
25foundation · easy
After the victim authenticates in a session fixation attack, what does the attacker do to gain access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.