Authentication GWEB Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A security team is investigating a session hijacking incident. They find that the attacker obtained a valid session token by sniffing unencrypted traffic. Which combination of controls would have most effectively prevented this attack?

   • AUse a complex session token and store it in a cookie
   • BSet the HttpOnly flag and use a short session timeout
   • CEnforce HTTPS and set the Secure flag on the session cookie
   • DRotate the session token after login and use SameSite=Strict
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a common weakness of password-based authentication?

   • APasswords are often weak and reused across multiple services, increasing the risk of credential stuffing attacks.
   • BPasswords cannot be stored securely on the server.
   • CPasswords are always transmitted in plaintext over the network.
   • DPasswords are immune to phishing attacks.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A web application allows users to stay logged in for 30 days. A security review recommends reducing the risk of session hijacking from stolen tokens. Which control is most effective?

   • ARotate the session token periodically and on privilege changes
   • BShorten the session timeout to 15 minutes
   • CStore the session token in a localStorage variable
   • DImplement absolute session expiration after 30 days
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's web app stores passwords as plaintext in the database. A breach exposes all user passwords. Which of the following is the most important immediate remediation?

   • AForce all users to change their passwords
   • BUse a strong, salted, adaptive hashing algorithm like bcrypt or Argon2
   • CEncrypt passwords with AES-256
   • DHash all passwords with SHA-256
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst is investigating a series of account takeovers. The application uses a session token that is generated using a linear congruential generator (LCG) and is transmitted in the URL. The analyst suspects that an attacker can predict the token. Which combination of weaknesses is most likely being exploited?

   • ALow entropy in token generation and token leakage via URL in logs or referrer headers.
   • BLack of HttpOnly flag and absence of Secure flag on the cookie.
   • CInsufficient session timeout and lack of logout functionality.
   • DSession fixation due to not rotating the token after login.
   Reveal Solution Discussion Select an answer first