Session Security & Business Logic GWEB Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of session-based access control?

   • ATo store the user's password in the session
   • BTo enforce authorization decisions based on the user's authenticated session
   • CTo prevent the user from logging in multiple times
   • DTo encrypt all data in the session
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is a common test to identify weak session IDs?

   • AChecking if the session cookie has the Secure attribute
   • BVerifying that the session ID is stored in a database
   • CCollecting multiple session IDs and analyzing them for patterns or low entropy
   • DEnsuring the session ID is not displayed in the URL
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A web application allows users to transfer money between accounts. The application stores the user's account balance in the session and uses it to validate transactions. A penetration tester discovers that the balance can be modified by changing a cookie value. Which of the following is the most secure way to handle the account balance?

   • AEncrypt the cookie containing the balance so that the client cannot read it.
   • BStore the account balance in a server-side database and retrieve it on each transaction request.
   • CSign the cookie containing the balance with a server-side secret.
   • DUse a hidden form field to store the balance and validate it on the server.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team is investigating a potential session hijacking incident. They have logs showing that a user's session was used from two different IP addresses within a short time. The application currently does not bind sessions to IP addresses or user agents. Which of the following is the most effective additional control to detect and prevent session hijacking?

   • AImplement IP address binding and invalidate the session if the IP address changes during the session.
   • BRequire re-authentication for every request.
   • CUse a longer session ID to make guessing more difficult.
   • DLog all session activity and review it manually.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security tester is reviewing a web application's session management. The tester captures a session ID before login and uses it after login successfully. Which vulnerability does this confirm?

   • ASession fixation, because the session ID was not regenerated after login.
   • BSession prediction, because the ID was guessable.
   • CSession hijacking, because the tester stole the ID from the user.
   • DInsecure transmission, because the ID was sent over HTTP.
   Reveal Solution Discussion Select an answer first