Which of the following is a secure way to store a session identifier on the client side?

In a cookie with the Secure and HttpOnly attributes

In a JavaScript global variable

Why is it important to clear the session cookie on the client side during logout?

To free up storage space on the client device

To prevent the server from logging the logout request

To ensure the user's password is removed from the browser

To prevent the browser from reusing the session ID in future requests

A web application allows users to log in and then access a dashboard. During a penetration test, an assessor discovers that the application accepts a session ID supplied in the URL query string and does not change the session ID after successful authentication. Which combination of controls should the development team implement to directly mitigate the identified risks?

Set the session cookie with the Secure flag and enforce a 30-minute idle timeout.

Bind the session to the user's IP address and log all session activity.

Use a longer random session ID and store it in a server-side cache with a 24-hour absolute timeout.

Regenerate the session ID upon login and configure the application to reject session IDs passed via the URL query string.

Which of the following is a test for session fixation vulnerability?

Using a different browser to access the application

Sending a large number of requests to see if the session expires

Checking if the session cookie is HttpOnly

Setting a session ID before login and checking if it remains the same after authentication

What is a recommended preventive measure against session hijacking?

Storing the session ID in a JavaScript variable

Allowing session IDs in URLs for convenience

Using HTTPS to encrypt session ID transmission

Using a predictable session ID for easier tracking

GIAC Certified Web Application Defender

Domain 2Objective 2

Session Security & Business Logic GWEB Practice Questions (Page 2)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

12concepts

Questions 6–10

6foundation · easy
Which of the following is a secure way to store a session identifier on the client side?
Select an answer first
7foundation · easy
Why is it important to clear the session cookie on the client side during logout?
Select an answer first
8application · medium
A web application allows users to log in and then access a dashboard. During a penetration test, an assessor discovers that the application accepts a session ID supplied in the URL query string and does not change the session ID after successful authentication. Which combination of controls should the development team implement to directly mitigate the identified risks?
Select an answer first
9foundation · easy
Which of the following is a test for session fixation vulnerability?
Select an answer first
10foundation · easy
What is a recommended preventive measure against session hijacking?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.