Web Application Session Management GWAPT Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A web application's logout function clears the session cookie on the client but does not invalidate the session on the server. A penetration tester notes that the session can be replayed after logout. Which of the following is the most complete remediation?

   • AInvalidate the session on the server side and clear the cookie on the client side.
   • BUse a longer session cookie expiration to ensure the browser clears it.
   • CAdd the HttpOnly flag to the session cookie.
   • DSet a short idle timeout to expire the session quickly after logout.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which standard or guideline provides comprehensive best practices for session management?

   • ARFC 2616
   • BOWASP Session Management Cheat Sheet
   • CISO 27001
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is a core component of session management?

   • ASQL query optimization
   • BLoad balancer health checks
   • CNetwork firewall configuration
   • DSession identifier generation
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A developer is reviewing the session management of a web application that handles financial transactions. The current session ID is a 32-character hexadecimal string generated using the application server's default PRNG, which has been shown to have a predictable pattern under load. The application also sends the session ID in a URL parameter when cookies are disabled. The security team requires that session IDs be resistant to prediction and that they not be exposed in URLs. Which combination of changes should the developer implement?

   • ASwitch to a cryptographically secure random number generator, increase the session ID length to at least 128 bits, and move the session ID to a cookie with the Secure and HttpOnly flags.
   • BUse a longer hexadecimal string from the same PRNG and rely on HTTPS to protect the URL parameter.
   • CGenerate the session ID using a hash of the user's username and current time, and place it in a cookie without flags.
   • DKeep the current generator but add a timestamp to the session ID to make it unique, and store it in a hidden form field.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A financial application requires users to re-authenticate after 10 minutes of inactivity, but also forces a full logout after 8 hours regardless of activity. A security auditor notes that the absolute timeout is too long for high-risk transactions. Which change best aligns with OWASP guidance while minimizing user friction?

   • AReduce the absolute timeout to 2 hours and keep the idle timeout at 10 minutes.
   • BIncrease the idle timeout to 30 minutes and keep the absolute timeout at 8 hours.
   • CSet the absolute timeout to 8 hours but require re-authentication only for transactions above a certain amount.
   • DRemove the absolute timeout and rely solely on the 10-minute idle timeout.
   Reveal Solution Discussion Select an answer first