Session Security & Business Logic GWEB Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A financial web application requires users to re-authenticate before performing high-risk transactions. The current session management uses a 60-minute idle timeout and a 24-hour absolute timeout. After a user logs out, the application deletes the session cookie but does not invalidate the server-side session record. Which additional control is most important to implement?

   • AStore the session ID in a signed JWT instead of a server-side session record.
   • BAdd the SameSite=Strict attribute to the session cookie.
   • CShorten the idle timeout to 15 minutes for all users.
   • DInvalidate the server-side session on logout and require re-authentication for any subsequent request with that session ID.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A web application has a session management policy that includes a 15-minute idle timeout and a 4-hour absolute timeout. A user logs in and then steps away from their computer for 20 minutes. When they return, they click a link in the application. What should the application do?

   • AInvalidate the session and require the user to log in again.
   • BPrompt the user to confirm they are still active before continuing.
   • CKeep the session active but log the inactivity for audit purposes.
   • DExtend the session because the user is still logged in and the absolute timeout has not been reached.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company's web application is deployed behind a load balancer that terminates TLS. The application sets a session cookie without the Secure flag. A penetration test reveals that the cookie is sent over plain HTTP when a user manually types the site's domain. Which remediation should be applied?

   • ASet the Secure flag on the session cookie and configure an HTTP-to-HTTPS redirect.
   • BUse a JavaScript-based cookie reader to detect if the cookie is being sent over HTTP.
   • CBind the session to the user's IP address and log all cookie usage.
   • DIncrease the session timeout to reduce the chance of interception.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is a required security property for a session identifier?

   • AIt must be the same for all users to simplify management
   • BIt must be unpredictable to an attacker
   • CIt must be a sequential number for easy tracking
   • DIt must be stored in a client-side database
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company's web application sets a session cookie without the Secure or HttpOnly attributes. The application is served over HTTPS, but it also has an HTTP endpoint that redirects to HTTPS. An attacker on the same network as a user wants to steal the user's session. Which attack path is most directly enabled by the missing cookie attributes?

   • AThe attacker performs a man-in-the-middle attack during the HTTP-to-HTTPS redirect and captures the session cookie in plaintext.
   • BThe attacker guesses the session ID because it is generated with insufficient entropy.
   • CThe attacker injects JavaScript into the page and reads the cookie via document.cookie.
   • DThe attacker uses a cross-site request from another origin and the browser automatically includes the session cookie.
   Reveal Solution Discussion Select an answer first