Why is it important to implement session expiration?

To ensure users are forced to change their passwords regularly

To prevent users from staying logged in for long periods

To improve the performance of the web server

To reduce the window of opportunity for an attacker to use a stolen session token

An organization is implementing MFA for its remote workforce. The security team wants to use a factor that is resistant to phishing and does not require users to carry a separate hardware token. Which factor combination best meets these requirements?

Password plus a push notification to a mobile app.

Password plus a one-time code sent via email.

Password plus a hardware security key that supports WebAuthn.

Password plus a biometric scan using the user's fingerprint.

A web application allows users to stay logged in on multiple devices. After a password change, the security team wants to ensure that all existing sessions are invalidated. Which approach is most effective?

Use a short session token that expires after 10 minutes.

Store a session version number in the user's record and increment it on password change; reject sessions with an old version.

Clear the user's cookies on the server by sending a Set-Cookie header with an expired date.

Rely on the session timeout to eventually expire all sessions.

A web application currently requires only a username and password. The security team wants to add MFA but is concerned about the cost of hardware tokens. Which MFA method provides a good balance of security and cost?

Security questions as a second factor

Hardware security keys for every user

TOTP via an authenticator app on the user's smartphone

Which of the following is a recommended best practice for session management?

Accept session tokens from any source without validation

Store session tokens in the URL to simplify debugging

Use the user's IP address as the session token

Set a reasonable session timeout to limit the lifetime of a session

GIAC Certified Web Application Defender

Domain 2Objective 1

Authentication GWEB Practice Questions (Page 3)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 11–15

11foundation · easy
Why is it important to implement session expiration?
Select an answer first
12application · medium
An organization is implementing MFA for its remote workforce. The security team wants to use a factor that is resistant to phishing and does not require users to carry a separate hardware token. Which factor combination best meets these requirements?
Select an answer first
13application · medium
A web application allows users to stay logged in on multiple devices. After a password change, the security team wants to ensure that all existing sessions are invalidated. Which approach is most effective?
Select an answer first
14expert · medium
A web application currently requires only a username and password. The security team wants to add MFA but is concerned about the cost of hardware tokens. Which MFA method provides a good balance of security and cost?
Select an answer first
15foundation · easy
Which of the following is a recommended best practice for session management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.