During a penetration test, an assessor logs out of a web application and then replays the session cookie. The application still grants access to authenticated resources. Which of the following is the most likely root cause?

The cookie was not set with the Secure flag.

The session cookie lacked the HttpOnly attribute.

The server-side session record was not invalidated on logout.

The application did not set a short idle timeout.

A security policy requires that a web application automatically log out users after 15 minutes of inactivity, but also requires that the session not be valid for more than 4 hours total. Which of the following is the most appropriate implementation?

Use only the idle timeout of 15 minutes and ignore the absolute timeout.

Track the last activity time and the session creation time; invalidate the session if either exceeds the respective limit.

Set the cookie to expire after 15 minutes and rely on the browser to clear it.

Use only the absolute timeout of 4 hours and ignore the idle timeout.

A web application allows users to open multiple tabs. When a user logs out in one tab, the other tabs still appear to be logged in. Which approach best addresses this issue while maintaining a good user experience?

Clear the cookie only in the tab that initiated logout.

Set a short idle timeout so other tabs expire quickly after logout.

Use a separate session token for each tab and invalidate only the tab that initiated logout.

Use a single shared session cookie and ensure the server invalidates the session on logout, causing all tabs to lose access on their next request.

A security auditor is evaluating a web application's session ID generation. The application generates session IDs using a linear congruential generator seeded with the current time in milliseconds. The IDs are 64 bits long and are transmitted over HTTPS. Which statement best describes the security of these session IDs?

The IDs are likely predictable because the generator is not cryptographically secure and the seed is based on a guessable value.

The IDs are secure because HTTPS prevents any attacker from seeing them, so predictability is irrelevant.

The IDs are secure because the seed changes every millisecond, making them unpredictable.

The IDs are secure because 64 bits of entropy is sufficient and HTTPS protects them in transit.

A security auditor is evaluating a session ID generation algorithm. The algorithm produces 128-bit values using a pseudo-random number generator (PRNG) seeded with the current timestamp. Which of the following is the most significant weakness?

The session ID is too long, causing performance issues.

The session ID is not regenerated after authentication.

The PRNG is not cryptographically secure, and the timestamp seed makes the output predictable.

The session ID is stored in a cookie, which is insecure.

GIAC Web Application Penetration Tester

Domain 4Objective 2

Web Application Session Management GWAPT Practice Questions (Page 8)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

9concepts

Questions 36–40

36application · medium
During a penetration test, an assessor logs out of a web application and then replays the session cookie. The application still grants access to authenticated resources. Which of the following is the most likely root cause?
Select an answer first
37application · medium
A security policy requires that a web application automatically log out users after 15 minutes of inactivity, but also requires that the session not be valid for more than 4 hours total. Which of the following is the most appropriate implementation?
Select an answer first
38application · medium
A web application allows users to open multiple tabs. When a user logs out in one tab, the other tabs still appear to be logged in. Which approach best addresses this issue while maintaining a good user experience?
Select an answer first
39application · medium
A security auditor is evaluating a web application's session ID generation. The application generates session IDs using a linear congruential generator seeded with the current time in milliseconds. The IDs are 64 bits long and are transmitted over HTTPS. Which statement best describes the security of these session IDs?
Select an answer first
40expert · hard
A security auditor is evaluating a session ID generation algorithm. The algorithm produces 128-bit values using a pseudo-random number generator (PRNG) seeded with the current timestamp. Which of the following is the most significant weakness?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.