A developer is implementing session ID generation for a new application. The current implementation uses a sequential number based on the user ID. Which change is most important to prevent session prediction?

Use a timestamp and the user ID concatenated together.

Use a cryptographically secure random number generator to create session IDs with at least 128 bits of entropy.

Use a hash of the user ID and a secret salt.

Use a random number generated by the client's browser.

A healthcare application requires that sessions expire after 15 minutes of inactivity, but users complain that they are logged out while filling out long forms. The product owner wants to extend the timeout to 60 minutes. Which approach balances security and usability?

Use a JavaScript timer to keep the session alive by sending background requests.

Implement a sliding expiration that resets on user activity, but require re-authentication for sensitive actions after 15 minutes of inactivity.

Disable the timeout entirely and rely on IP binding.

Set the timeout to 60 minutes for all users and all actions.

A web application uses a session attribute to store the user's role. A bug allows a user to change their role by modifying a hidden form field. Which control would prevent this privilege escalation?

Use a longer role name to make it harder to guess.

Encrypt the hidden form field so the user cannot read it.

Log all role changes and review them weekly.

Store the role on the server-side session and never accept it from client input.

A developer is implementing login for a banking application. The current code accepts a session ID from the URL query string and does not change it after authentication. Which change is most important to prevent session fixation?

Generate a new session ID after successful login and never accept session IDs from the URL.

Set a short absolute timeout and require re-authentication for each transaction.

Bind the session to the user's IP address and user-agent string.

Use a longer session ID and store it in a cookie with the HttpOnly flag.

GIAC Certified Web Application Defender

Domain 2Objective 2

Session Security & Business Logic GWEB Practice Questions (Page 5)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

12concepts

Questions 21–25

21foundation · easy
Which cookie attribute prevents client-side scripts from accessing the session cookie?
Select an answer first
22application · medium
A developer is implementing session ID generation for a new application. The current implementation uses a sequential number based on the user ID. Which change is most important to prevent session prediction?
Select an answer first
23expert · hard
A healthcare application requires that sessions expire after 15 minutes of inactivity, but users complain that they are logged out while filling out long forms. The product owner wants to extend the timeout to 60 minutes. Which approach balances security and usability?
Select an answer first
24application · medium
A web application uses a session attribute to store the user's role. A bug allows a user to change their role by modifying a hidden form field. Which control would prevent this privilege escalation?
Select an answer first
25application · medium
A developer is implementing login for a banking application. The current code accepts a session ID from the URL query string and does not change it after authentication. Which change is most important to prevent session fixation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.