Web Application Session Management GWAPT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of an idle session timeout?

   • ATo invalidate a session after a period of user inactivity
   • BTo encrypt the session data
   • CTo regenerate the session ID periodically
   • DTo force the user to re-authenticate after a fixed total time
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which timeout policy is most effective at limiting the total lifetime of a session regardless of user activity?

   • AAbsolute timeout
   • BIdle timeout
   • CSession regeneration
   • DCookie expiration
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of a web application session?

   • ATo encrypt all data transmitted between the client and server
   • BTo maintain state across multiple HTTP requests from the same user
   • CTo provide a permanent record of all user actions for auditing
   • DTo store the user's password on the server for authentication
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a session fixation attack, what does the attacker do?

   • AForces the victim to use a session ID chosen by the attacker
   • BGuesses the victim's session ID through brute force
   • CIntercepts the victim's session ID after login
   • DDeletes the victim's session cookie
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a potential security concern when a user has multiple concurrent sessions on different devices?

   • AConcurrent sessions increase the risk of session fixation
   • BIf one session is compromised, the attacker may not have access to other sessions
   • CLogging out on one device does not automatically invalidate sessions on other devices
   • DAll sessions share the same session ID
   Reveal Solution Discussion Select an answer first