A web application is being redesigned. The security architect wants to implement secure session management to prevent session fixation. Which set of practices should be included in the design?

Use a single long-lived session ID for the entire user lifetime

Store session IDs in client-side JavaScript variables

Accept session IDs from both cookies and query strings for flexibility

Regenerate session IDs on privilege changes, reject invalid session IDs, and set appropriate session timeouts

Which technique is used to validate that a session ID belongs to the legitimate user?

Storing the session ID in a hidden form field.

Encrypting the session ID with a secret key.

Comparing the user agent string stored at login with the user agent in subsequent requests.

An attacker is planning a session fixation attack against a web application that uses cookies for session management. The application does not accept session IDs from URLs or forms. Which delivery method could the attacker use to set the victim's session ID?

Use a man-in-the-middle attack to modify the session cookie in transit.

Send the victim a link with a fixed session ID in the query string.

Exploit a cross-site scripting (XSS) vulnerability to set the session cookie via JavaScript.

Submit a hidden form field with a fixed session ID.

EC-CouncilWeb Application Hacking and Security

Domain 8Objective 2

Session Fixation WAHS Practice Questions (Page 9)

Part of the Authentication and Session Management domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~25–41 in this domain), expect 8–14 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

9concepts

Questions 41–43

41application · medium
A web application is being redesigned. The security architect wants to implement secure session management to prevent session fixation. Which set of practices should be included in the design?
Select an answer first
42foundation · easy
Which technique is used to validate that a session ID belongs to the legitimate user?
Select an answer first
43application · hard
An attacker is planning a session fixation attack against a web application that uses cookies for session management. The application does not accept session IDs from URLs or forms. Which delivery method could the attacker use to set the victim's session ID?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Session Fixation WAHS Practice Questions (Page 9)

Questions 41–43

A web application is being redesigned. The security architect wants to implement secure session management to prevent session fixation. Which set of practices should be included in the design?

Which technique is used to validate that a session ID belongs to the legitimate user?

An attacker is planning a session fixation attack against a web application that uses cookies for session management. The application does not accept session IDs from URLs or forms. Which delivery method could the attacker use to set the victim's session ID?

Keep studying — Authentication and Session Management