Web Application Session Management GWAPT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A penetration tester discovers that the application accepts a session ID provided in the login request and continues to use that same ID after successful authentication. Which control would most directly mitigate the session fixation vulnerability?

   • AImplement an idle timeout of 15 minutes.
   • BSet the HttpOnly flag on the session cookie.
   • CUse a secure cookie with the Secure flag.
   • DRegenerate the session ID immediately after successful authentication.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A web application's logout function is implemented as a GET request that clears the session cookie. A security review notes that the logout can be triggered by a cross-site request, and that the server-side session is not invalidated. Which two changes should be made to improve logout security?

   • AKeep the GET request but add a confirmation prompt using JavaScript.
   • BRedirect the user to a logout confirmation page that uses a meta refresh.
   • CSet the cookie's Max-Age to 0 and rely on the browser to delete it.
   • DChange logout to a POST request with CSRF protection, and invalidate the server-side session.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A penetration tester is assessing a web application that uses a session cookie without the Secure flag. The application is accessible over both HTTP and HTTPS, and the tester successfully captures a session cookie over an unencrypted HTTP request. Which of the following is the most effective mitigation to prevent this specific attack?

   • AImplement a short idle timeout to limit the window of opportunity.
   • BUse a Content Security Policy (CSP) to block mixed content.
   • CSet the Secure flag on the session cookie and enforce HTTPS for all requests, including redirects.
   • DSet the HttpOnly flag on the session cookie.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A session ID is generated using a predictable algorithm based on the current time. Which weakness does this introduce?

   • ALow entropy
   • BHigh collision rate
   • CInsufficient length
   • DWeak encryption
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A penetration tester is evaluating a web application that uses a session cookie with the SameSite=Lax attribute. The tester attempts a session fixation attack by setting the victim's session ID via a cross-site request. Which of the following is the most accurate assessment?

   • ASameSite=Lax prevents the attacker from knowing the session ID, so fixation is impossible.
   • BSameSite=Lax completely blocks the fixation attack because the cookie will not be sent on cross-site requests.
   • CSameSite=Lax is irrelevant to session fixation; only the Secure flag matters.
   • DSameSite=Lax does not prevent the initial setting of the cookie via a top-level navigation, so fixation may still succeed if the server does not regenerate the ID after login.
   Reveal Solution Discussion Select an answer first