What should a proper logout mechanism do?

Invalidate the session on the server and clear the session token on the client

Redirect the user to the login page without any server-side action

Only invalidate the session on the server

Only clear the session token on the client

A developer is designing a session management system. They want to ensure that a stolen session token cannot be used after the user logs out. Which approach is most effective?

Invalidate the session on the server when the user logs out

Store the session token in a cookie with a short expiration

Rotate the token every 5 minutes

Use a long random token and store it in localStorage

A developer is designing a session token generator for a high-security web application. The token must be unpredictable and resistant to brute-force attacks. Which implementation is most appropriate?

Use a timestamp concatenated with the user ID and encode it in base64.

Use a random number generator seeded with the current time and generate a 32-bit token.

Use a hash of the user's password as the session token.

Use a cryptographically secure random number generator to produce a 256-bit token and store only a hash of the token server-side.

A developer proposes using a timestamp plus a counter as the session token. The security architect rejects this. What is the primary reason?

The token is predictable and has low entropy

The token is not stored in a cookie

GIAC Certified Web Application Defender

Domain 2Objective 1

Authentication GWEB Practice Questions (Page 10)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 46–50

46foundation · easy
What should a proper logout mechanism do?
Select an answer first
47expert · medium
A developer is designing a session management system. They want to ensure that a stolen session token cannot be used after the user logs out. Which approach is most effective?
Select an answer first
48application · medium
A developer is designing a session token generator for a high-security web application. The token must be unpredictable and resistant to brute-force attacks. Which implementation is most appropriate?
Select an answer first
49expert · medium
A developer proposes using a timestamp plus a counter as the session token. The security architect rejects this. What is the primary reason?
Select an answer first
50application · medium
A user reports that after logging into a banking site, they are redirected to a page that asks them to log in again, and then their account is compromised. The attacker had previously set a known session ID in the user's browser. Which attack occurred?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.