How can a signed token (e.g., a JWT) protect session data integrity?

By encrypting the token so that only the server can read it

By using a digital signature that can be verified by the server to detect any tampering

By storing the token in a secure cookie

An online voting application allows each user to vote once. The application stores a 'hasVoted' flag in the session. A user discovers that clearing cookies allows them to vote again. Which remediation is most effective?

Use a signed cookie for the 'hasVoted' flag.

Use a longer random session ID to make it harder to guess.

Store the 'hasVoted' flag on the server-side session and also enforce that the user is authenticated before voting.

Set the cookie to expire after 24 hours.

A web application currently stores session data in a signed cookie. The application is being redesigned to improve security. The team is considering moving to server-side session storage. Which of the following is the most important security advantage of server-side storage over signed cookies?

It prevents the client from viewing or tampering with session data.

It eliminates the need for session timeouts.

It allows the application to scale horizontally without a shared session store.

It makes the application faster because there is no cookie to send.

How can an attacker exploit session state to perform a privilege escalation attack?

By modifying a session variable that stores the user's role or privilege level

GIAC Certified Web Application Defender

Domain 2Objective 2

Session Security & Business Logic GWEB Practice Questions (Page 1)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

12concepts

Questions 1–5

1application · medium
A developer is implementing login logic. The current code does not regenerate the session ID after authentication. Which attack is the developer most likely to mitigate by adding session ID regeneration?
Select an answer first
2foundation · easy
How can a signed token (e.g., a JWT) protect session data integrity?
Select an answer first
3expert · hard
An online voting application allows each user to vote once. The application stores a 'hasVoted' flag in the session. A user discovers that clearing cookies allows them to vote again. Which remediation is most effective?
Select an answer first
4expert · hard
A web application currently stores session data in a signed cookie. The application is being redesigned to improve security. The team is considering moving to server-side session storage. Which of the following is the most important security advantage of server-side storage over signed cookies?
Select an answer first
5foundation · easy
How can an attacker exploit session state to perform a privilege escalation attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.