Authentication GWEB Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A user logs out of a web application, but the session token remains valid on the server. What is the most likely consequence?

   • AThe user's password will be reset.
   • BAn attacker who obtains the token can continue to use the session after logout.
   • CThe session token will be rotated to a new value.
   • DThe user will be automatically logged out after a short timeout.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A web application is behind a CDN that terminates TLS. The application sets a session cookie with the Secure flag. What is the primary security concern?

   • AThe cookie will be blocked by the browser
   • BThe cookie will not be sent over HTTPS
   • CThe CDN can see the session token in clear text
   • DThe cookie will expire too quickly
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   Which cookie attribute helps protect a session token from being accessed by client-side scripts?

   • ASameSite
   • BHttpOnly
   • CSecure
   • DDomain
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Which of the following is a recommended source for generating session tokens?

   • AA cryptographically secure pseudo-random number generator (CSPRNG)
   • BAn incrementing integer stored in a database
   • CA timestamp-based value such as the current Unix time
   • DThe user's username hashed with MD5
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A development team is building a session management system for a high-traffic e-commerce site. They need to balance security with performance. The current design stores session data in a database, which causes latency. They are considering storing the session token as a signed JWT in a cookie. Which concern is most critical to address?

   • AThe JWT should not have an expiration time to avoid re-issuing tokens.
   • BThe JWT should be encrypted to hide the user's role from the client.
   • CThe JWT should be stored in localStorage for faster access.
   • DThe JWT must be signed with a strong algorithm and the secret must be protected; otherwise, attackers can forge tokens.
   Reveal Solution Discussion Select an answer first