A company's web application is used on shared public computers. Users often forget to log out, and the next user can access the previous user's account. Management wants to reduce this risk without requiring users to change their behavior. Which control is most effective?

Use a longer session cookie expiration time to give users more time to finish their work.

Disable the logout button to prevent accidental logout.

Implement an idle session timeout that automatically logs out users after a short period of inactivity.

Store the session token in localStorage so it persists across browser restarts.

Why is it recommended to rotate (regenerate) the session token after a user authenticates?

To ensure the token is stored in a cookie

To make the token more memorable for the user

To reduce the size of the token

To prevent session fixation attacks

A company wants to implement MFA but is concerned about usability. They are considering using a biometric (fingerprint) as the second factor. What is a key consideration?

Biometrics are less secure than passwords

Biometrics cannot be changed if compromised

Biometrics require a hardware token

Biometrics are a possession factor

A security review of a web application reveals that session cookies are transmitted over HTTPS but are accessible to JavaScript. The application also does not invalidate the session on the server when the user closes the browser. Which two changes should be made to improve session security?

Set the SameSite attribute to Strict and extend the session timeout to 24 hours.

Set the HttpOnly flag on the session cookie and implement server-side session invalidation on logout.

Set the Secure flag on the session cookie and rely on browser closing to end the session.

Use a JavaScript variable to store the session token and clear it on unload.

What is the primary purpose of a session token in a web application?

To store the user's IP address for tracking purposes

To maintain state across stateless HTTP requests by identifying the user's session

To encrypt all data transmitted between the client and server

To store the user's password for future logins

GIAC Certified Web Application Defender

Domain 2Objective 1

Authentication GWEB Practice Questions (Page 5)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 21–25

21application · medium
A company's web application is used on shared public computers. Users often forget to log out, and the next user can access the previous user's account. Management wants to reduce this risk without requiring users to change their behavior. Which control is most effective?
Select an answer first
22foundation · easy
Why is it recommended to rotate (regenerate) the session token after a user authenticates?
Select an answer first
23expert · medium
A company wants to implement MFA but is concerned about usability. They are considering using a biometric (fingerprint) as the second factor. What is a key consideration?
Select an answer first
24application · medium
A security review of a web application reveals that session cookies are transmitted over HTTPS but are accessible to JavaScript. The application also does not invalidate the session on the server when the user closes the browser. Which two changes should be made to improve session security?
Select an answer first
25foundation · easy
What is the primary purpose of a session token in a web application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.