What is the primary risk of transmitting a session identifier over an unencrypted HTTP connection?

The session ID will be stored in the browser's history

The session ID will be logged by the web server

An attacker on the network can intercept the session ID and hijack the session

The session ID will be automatically invalidated by the server

Which of the following is an example of a business logic flaw related to session state?

Setting an idle timeout of 30 minutes

Using HTTPS for all session transmissions

Regenerating the session ID after login

Allowing a user to change the price of an item by modifying a session variable

A web application stores the user's account type (e.g., 'free' or 'premium') in a client-side cookie. A user changes the cookie value to 'premium' and gains access to premium features. Which control would prevent this tampering?

Use a checksum to detect changes.

Use a longer account type string to make it harder to guess.

Store the account type on the server-side session and derive it from the authenticated user's database record.

Encrypt the cookie with a secret key.

A web application uses a session-based access control model. The application stores the user's role in the session and checks it on every request. A penetration tester discovers that the role value can be modified by changing a hidden form field. Which of the following is the most effective way to prevent this privilege escalation?

Use a JavaScript check to verify the role before submitting the form.

Sign the hidden form field with a server-side secret to prevent tampering.

Store the role in a server-side session and never accept role values from client input.

Encrypt the hidden form field so that the client cannot read or modify it.

What is the primary purpose of session management in a web application?

To maintain state across stateless HTTP requests by associating a user with a server-side session

To encrypt all data transmitted between the client and the server

To store user passwords in a secure format on the server

To provide a unique identifier for each HTTP request

GIAC Certified Web Application Defender

Domain 2Objective 2

Session Security & Business Logic GWEB Practice Questions (Page 9)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

12concepts

Questions 41–45

41foundation · easy
What is the primary risk of transmitting a session identifier over an unencrypted HTTP connection?
Select an answer first
42foundation · easy
Which of the following is an example of a business logic flaw related to session state?
Select an answer first
43application · medium
A web application stores the user's account type (e.g., 'free' or 'premium') in a client-side cookie. A user changes the cookie value to 'premium' and gains access to premium features. Which control would prevent this tampering?
Select an answer first
44expert · hard
A web application uses a session-based access control model. The application stores the user's role in the session and checks it on every request. A penetration tester discovers that the role value can be modified by changing a hidden form field. Which of the following is the most effective way to prevent this privilege escalation?
Select an answer first
45foundation · easy
What is the primary purpose of session management in a web application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.