Session Fixation WAHS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a common method an attacker uses to deliver a fixed session ID to a victim?

   • AEmbedding the session ID in the server's HTTP response headers.
   • BUsing a DNS rebinding attack to change the session ID.
   • CStoring the session ID in the victim's browser history.
   • DIncluding the session ID in a URL query parameter.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which automated testing approach can help identify session fixation vulnerabilities?

   • AUsing a password cracking tool to test authentication strength.
   • BUsing a fuzzer to send random session IDs.
   • CUsing a web vulnerability scanner that checks if the session ID changes after login.
   • DUsing a network sniffer to capture session cookies.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security engineer is implementing session management for a high-security web application. The application must support users who log in from multiple devices and also allow single sign-on (SSO) via an external identity provider. The engineer wants to prevent session fixation while minimizing disruption to legitimate users. Which approach is BEST?

   • ABind the session to the user's IP address and reject any request from a different IP
   • BDo not regenerate the session ID after SSO to avoid breaking the SSO flow
   • CUse a single session ID that is shared across all devices
   • DRegenerate the session ID after each authentication event, including SSO callbacks, and invalidate the old session ID
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security tester is using an automated scanner to check for session fixation. The scanner reports that the application does not regenerate session IDs after login. Which additional manual test should the tester perform to confirm the vulnerability?

   • ASet a known session ID in the browser, log in, and then check if the same session ID is still active after authentication.
   • BTest whether the session expires after a long period of inactivity.
   • CAttempt to brute-force session IDs.
   • DCheck if the session cookie has the Secure flag set.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A developer is implementing a login function. The application currently uses a cookie-based session. Which code change would BEST prevent session fixation?

   • AStore the session ID in a database and validate it against the user's password hash
   • BSet the session cookie's Expires attribute to a far-future date
   • CUse the same session ID for the entire user session to maintain state
   • DCall a function that generates a new session ID and replaces the old one immediately after the user's credentials are verified
   Reveal Solution Discussion Select an answer first