Which scenario is an example of session hijacking rather than session fixation?

An attacker embeds a session ID in a hidden form field, and the victim submits the form.

An attacker sends a victim a link with a session ID in the URL, and the victim logs in.

An attacker sets a cookie on the victim's browser via a subdomain, and the victim logs in.

An attacker uses a packet sniffer to capture the victim's session cookie after login.

Which practice is a secure session management best practice?

Using long session timeouts to keep users logged in.

Storing session IDs in client-side JavaScript variables.

Accepting session IDs from URL parameters for convenience.

Setting the Secure flag on session cookies so they are only sent over HTTPS.

A developer is reviewing a web application's session management code. The application currently accepts session IDs from URL query parameters and does not regenerate the session ID after login. Which vulnerability is the application MOST likely exposed to?

Cross-site request forgery (CSRF)

A development team is implementing secure session management for a new application. They want to prevent session fixation and other session-related attacks. Which set of practices should they implement?

Rely on IP address binding and do not regenerate session IDs to avoid disrupting users on mobile networks.

Use HttpOnly and Secure cookies, regenerate the session ID after login, and reject session IDs that were not issued by the server.

Use a short session timeout and store the session ID in a JavaScript variable for faster access.

Accept session IDs from both cookies and URL parameters to support multiple client types.

A junior developer asks a senior developer to explain session fixation. The senior developer says, 'In session fixation, the attacker ______.' Which completion is correct?

intercepts the session identifier during transmission over the network.

guesses the victim's session identifier through brute force.

sets the victim's session identifier to a value known to the attacker before the victim authenticates.

steals the victim's session identifier after authentication and uses it to impersonate the victim.

EC-CouncilWeb Application Hacking and Security

Domain 8Objective 2

Session Fixation WAHS Practice Questions (Page 8)

Part of the Authentication and Session Management domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~25–41 in this domain), expect 8–14 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

9concepts

Questions 36–40

36foundation · easy
Which scenario is an example of session hijacking rather than session fixation?
Select an answer first
37foundation · easy
Which practice is a secure session management best practice?
Select an answer first
38application · medium
A developer is reviewing a web application's session management code. The application currently accepts session IDs from URL query parameters and does not regenerate the session ID after login. Which vulnerability is the application MOST likely exposed to?
Select an answer first
39application · medium
A development team is implementing secure session management for a new application. They want to prevent session fixation and other session-related attacks. Which set of practices should they implement?
Select an answer first
40application · easy
A junior developer asks a senior developer to explain session fixation. The senior developer says, 'In session fixation, the attacker ______.' Which completion is correct?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.