What is the primary reason for generating session identifiers with high entropy?

To prevent attackers from predicting or guessing valid session IDs

To ensure the session ID is unique across different servers

To make the session ID human-readable for debugging

To reduce the size of the session ID stored in the cookie

What is the purpose of an idle timeout for a session?

To terminate the session after a period of inactivity

To force the user to re-authenticate after a fixed total session duration

To keep the session alive indefinitely as long as the user is logged in

To prevent the session ID from being reused after logout

GIAC Certified Web Application Defender

Domain 2Objective 2

Session Security & Business Logic GWEB Practice Questions (Page 11)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

12concepts

Questions 51–52

51foundation · easy
What is the primary reason for generating session identifiers with high entropy?
Select an answer first
52foundation · easy
What is the purpose of an idle timeout for a session?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Session Security & Business Logic GWEB Practice Questions (Page 11)

Questions 51–52

What is the primary reason for generating session identifiers with high entropy?

What is the purpose of an idle timeout for a session?

Keep studying — Authentication and Session Management