A web application sets a session cookie without the HttpOnly flag. An XSS vulnerability is discovered. What is the most likely impact?

The attacker can perform CSRF attacks

The attacker can force the user to log out

The attacker can modify the session cookie

The attacker can read the session cookie and hijack the session

A web application is deployed behind a load balancer that terminates TLS. The session cookie is set without the Secure flag. What is the primary risk?

The cookie is accessible to JavaScript, enabling XSS attacks.

The cookie will not be sent to the server if the user's browser is in private mode.

The cookie can be intercepted in transit if the application is accessed over HTTP.

The cookie is vulnerable to CSRF attacks.

A user reports that after logging into a banking site, they are redirected to a page that asks them to re-enter their password. The URL contains a session ID parameter. Later, the user notices unauthorized transactions. Which attack most likely occurred, and what is the best mitigation?

Password spraying; the attacker used the re-login page to brute-force the password.

Session fixation; the attacker set the session ID before login, and the application did not rotate the token after authentication.

Session hijacking; the attacker guessed the session ID from the URL and used it after login.

Cross-site request forgery; the attacker forced the user to submit a transaction.

Why is it important for session tokens to have high entropy?

To make tokens shorter and easier to transmit

To ensure tokens are unique across all users

To make tokens harder to guess or brute-force

To allow tokens to be stored in cookies

GIAC Certified Web Application Defender

Domain 2Objective 1

Authentication GWEB Practice Questions (Page 7)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 31–35

31expert · medium
A web application sets a session cookie without the HttpOnly flag. An XSS vulnerability is discovered. What is the most likely impact?
Select an answer first
32application · medium
A web application is deployed behind a load balancer that terminates TLS. The session cookie is set without the Secure flag. What is the primary risk?
Select an answer first
33application · medium
A user reports that after logging into a banking site, they are redirected to a page that asks them to re-enter their password. The URL contains a session ID parameter. Later, the user notices unauthorized transactions. Which attack most likely occurred, and what is the best mitigation?
Select an answer first
34foundation · easy
Why is it important for session tokens to have high entropy?
Select an answer first
35application · medium
A security auditor finds that a web application's session cookie is accessible to JavaScript and is sent over HTTP. Which two cookie attributes should be set to mitigate session hijacking via XSS and network sniffing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.