Weak Session Management - Session Hijacking & Fixes - MCQ Questions

1. What is session hijacking?

A) Gaining unauthorized access to a user’s session
B) Logging out a user forcefully
C) Encrypting a user session with a stronger key
D) Blocking a user from logging in

✅ Answer: A) Gaining unauthorized access to a user’s session
📌 Explanation: Session hijacking is when an attacker takes over a user’s active session, allowing them to impersonate the legitimate user.

2. Which of the following is a common method for session hijacking?

A) SQL Injection
B) Man-in-the-Middle (MITM) Attack
C) Password Spraying
D) Keylogging

✅ Answer: B) Man-in-the-Middle (MITM) Attack
📌 Explanation: MITM attacks intercept communication between a user and the server, allowing an attacker to steal or manipulate session data.

3. What is the primary cause of session hijacking?

A) Weak encryption algorithms
B) Unsecured session IDs
C) Long, complex passwords
D) Strong two-factor authentication

✅ Answer: B) Unsecured session IDs
📌 Explanation: If session IDs are exposed (e.g., in URLs, cookies, or logs), attackers can steal and use them to hijack a session.

4. What is the best way to protect session IDs in web applications?

A) Store them in browser local storage
B) Use HTTP-only and Secure cookies
C) Include session IDs in URLs
D) Store session IDs in JavaScript variables

✅ Answer: B) Use HTTP-only and Secure cookies
📌 Explanation: HTTP-only prevents JavaScript from accessing session cookies, and Secure ensures they are only transmitted over HTTPS.

5. Which of the following is a common technique used to steal session cookies?

A) Cross-Site Scripting (XSS)
B) Firewall bypassing
C) CAPTCHA breaking
D) Brute-force login attempts

✅ Answer: A) Cross-Site Scripting (XSS)
📌 Explanation: XSS allows attackers to inject malicious scripts that can steal cookies containing session IDs.

6. What is “session fixation”?

A) Assigning a new session ID after login
B) Keeping session IDs the same for security
C) Forcing a user to use a predefined session ID
D) Expiring sessions after a timeout

✅ Answer: C) Forcing a user to use a predefined session ID
📌 Explanation: In a session fixation attack, the attacker tricks the victim into using a session ID that the attacker already knows.

7. Which HTTP header helps prevent session hijacking in modern browsers?

A) Content-Type
B) Referrer-Policy
C) Strict-Transport-Security (HSTS)
D) X-Frame-Options

✅ Answer: C) Strict-Transport-Security (HSTS)
📌 Explanation: HSTS enforces HTTPS connections, preventing attackers from intercepting session cookies in transit.

8. How does enabling “SameSite” on cookies improve session security?

A) It allows cookies to be sent across different domains
B) It prevents cookies from being sent in cross-site requests
C) It encrypts cookies at rest
D) It forces cookies to expire immediately after use

✅ Answer: B) It prevents cookies from being sent in cross-site requests
📌 Explanation: The “SameSite” attribute prevents cookies from being included in requests from external sites, reducing CSRF risks.

9. What is the recommended session timeout duration for highly sensitive applications?

A) 10-15 minutes
B) 30-60 minutes
C) 2-4 hours
D) Never expire

✅ Answer: A) 10-15 minutes
📌 Explanation: Short session timeouts reduce the risk of unauthorized access if a user forgets to log out.

10. Why should session IDs be regenerated after login?

A) To ensure session persistence
B) To prevent session fixation attacks
C) To make it easier to track users
D) To improve website performance

✅ Answer: B) To prevent session fixation attacks
📌 Explanation: Regenerating session IDs after login ensures that attackers cannot reuse an old session ID.

11. Which of the following is NOT a best practice for session management?

A) Using HTTPS for session transmission
B) Storing session IDs in URLs
C) Implementing session expiration
D) Using strong random session IDs

✅ Answer: B) Storing session IDs in URLs
📌 Explanation: Storing session IDs in URLs makes them easily accessible to attackers through browser history and referrer headers.

12. What is a key characteristic of a strong session ID?

A) Short and easy to remember
B) Predictable and sequential
C) Long, random, and unique
D) Hardcoded in JavaScript

✅ Answer: C) Long, random, and unique
📌 Explanation: Secure session IDs should be unpredictable to prevent attackers from guessing them.

13. What type of attack exploits long-lived session cookies?

A) Session replay attack
B) Cross-Site Request Forgery (CSRF)
C) Password spraying
D) Brute-force attack

✅ Answer: A) Session replay attack
📌 Explanation: In session replay attacks, an attacker intercepts and reuses a valid session token.

14. How does enabling Two-Factor Authentication (2FA) help prevent session hijacking?

A) It completely eliminates the need for session management
B) It encrypts the session ID on the client side
C) It requires an additional verification step, reducing the impact of stolen session IDs
D) It prevents session IDs from being generated

✅ Answer: C) It requires an additional verification step, reducing the impact of stolen session IDs
📌 Explanation: Even if a session ID is stolen, an attacker still needs 2FA verification to gain access.

15. Which security measure helps detect session hijacking attempts?

A) Monitoring for session anomalies (e.g., IP or device changes)
B) Disabling session expiration
C) Storing session IDs in local storage
D) Allowing multiple concurrent logins

✅ Answer: A) Monitoring for session anomalies (e.g., IP or device changes)
📌 Explanation: Detecting unusual session activity (e.g., location changes) can help identify hijacked sessions.

16. Which security control can automatically log out inactive users?

A) Session inactivity timeout
B) CAPTCHA
C) Rate limiting
D) IP whitelisting

✅ Answer: A) Session inactivity timeout
📌 Explanation: Setting an inactivity timeout helps protect against session hijacking by closing idle sessions.

17. What is a primary goal of session management?

A) Improving website loading speed
B) Enhancing security while maintaining user experience
C) Disabling authentication mechanisms
D) Allowing users to stay logged in indefinitely

✅ Answer: B) Enhancing security while maintaining user experience
📌 Explanation: A secure session management system balances security and usability.

18. Which attack allows an attacker to capture and reuse a valid session token?

A) Cross-Site Scripting (XSS)
B) Session Replay Attack
C) Cross-Site Request Forgery (CSRF)
D) SQL Injection

✅ Answer: B) Session Replay Attack
📌 Explanation: Session replay occurs when an attacker captures a valid session token and reuses it to impersonate the user.

19. Which setting should be enabled on session cookies to restrict them to HTTPS connections only?

A) Secure flag
B) Domain flag
C) Path flag
D) Expires flag

✅ Answer: A) Secure flag
📌 Explanation: The Secure flag ensures that cookies are only sent over HTTPS, preventing attackers from intercepting them over unencrypted connections.

20. What is a key difference between session hijacking and session fixation?

A) Session hijacking involves stealing a valid session, while session fixation forces a user into a known session ID
B) Session fixation only happens on mobile devices
C) Session hijacking requires physical access to a user’s computer
D) Session hijacking only affects cloud-based applications

✅ Answer: A) Session hijacking involves stealing a valid session, while session fixation forces a user into a known session ID
📌 Explanation: Session fixation occurs when an attacker tricks a user into using a predetermined session ID, whereas hijacking involves stealing an active session.

21. Why should session IDs be long and random?

A) To increase performance
B) To prevent brute-force guessing
C) To allow easier tracking of users
D) To reduce database storage requirements

✅ Answer: B) To prevent brute-force guessing
📌 Explanation: Short or predictable session IDs are vulnerable to brute-force attacks where attackers try different session IDs until they find a valid one.

22. Which of the following is a method used to prevent session hijacking?

A) Allowing session IDs in URLs
B) Disabling browser encryption
C) Implementing token-based authentication
D) Storing session IDs in JavaScript variables

✅ Answer: C) Implementing token-based authentication
📌 Explanation: Token-based authentication (such as JWT) ensures better security by reducing the reliance on cookies for session management.

23. Why is it a bad practice to store session IDs in browser local storage?

A) Local storage is cleared every time the browser is closed
B) Local storage is vulnerable to XSS attacks
C) Local storage only works with HTTP requests
D) Session IDs need to be stored in plaintext

✅ Answer: B) Local storage is vulnerable to XSS attacks
📌 Explanation: Local storage is accessible via JavaScript, making session IDs vulnerable to theft if an XSS attack occurs.

24. How does IP binding help prevent session hijacking?

A) It binds the session to the user’s IP address
B) It encrypts the session ID
C) It forces a session to expire after 24 hours
D) It requires multi-factor authentication for every request

✅ Answer: A) It binds the session to the user’s IP address
📌 Explanation: IP binding ensures that a session is only valid if requests originate from the same IP address, preventing attackers from using stolen session IDs from a different location.

25. What is the main risk of allowing concurrent logins from multiple devices?

A) Increased server load
B) Difficulty in tracking user activity
C) Higher risk of session hijacking
D) Slower application performance

✅ Answer: C) Higher risk of session hijacking
📌 Explanation: Allowing multiple active sessions increases the attack surface, making it easier for attackers to hijack an open session.

26. What is the primary reason for implementing session expiration?

A) To improve user experience
B) To automatically log out inactive users
C) To increase CPU efficiency
D) To reduce network traffic

✅ Answer: B) To automatically log out inactive users
📌 Explanation: Session expiration helps reduce the risk of hijacked sessions by automatically logging out users after a period of inactivity.

27. What type of attack involves injecting malicious code into a website to steal session cookies?

A) SQL Injection
B) Cross-Site Scripting (XSS)
C) Cross-Site Request Forgery (CSRF)
D) Man-in-the-Middle (MITM)

✅ Answer: B) Cross-Site Scripting (XSS)
📌 Explanation: XSS allows attackers to inject scripts that can steal session cookies from unsuspecting users.

28. How can a web application detect and prevent session hijacking?

A) By enforcing IP-based session validation
B) By disabling JavaScript
C) By storing session IDs in plaintext
D) By allowing unlimited session duration

✅ Answer: A) By enforcing IP-based session validation
📌 Explanation: Monitoring IP changes in an active session can help detect hijacking attempts.

29. Why is using “HttpOnly” important for session cookies?

A) It prevents the cookie from being accessed by JavaScript
B) It ensures the cookie expires in 10 minutes
C) It makes cookies readable by other websites
D) It forces the user to enter their password for every request

✅ Answer: A) It prevents the cookie from being accessed by JavaScript
📌 Explanation: HttpOnly cookies are protected from JavaScript-based attacks like XSS.

30. Which authentication mechanism provides additional protection against session hijacking?

A) CAPTCHA
B) Two-Factor Authentication (2FA)
C) Rate limiting
D) Password strength policies

✅ Answer: B) Two-Factor Authentication (2FA)
📌 Explanation: Even if a session is hijacked, 2FA ensures the attacker cannot access the account without a second authentication factor.

31. Which of the following is NOT a common way to steal session cookies?

A) Man-in-the-Middle (MITM) Attack
B) Cross-Site Scripting (XSS)
C) Secure session cookie management
D) Packet sniffing on unencrypted connections

✅ Answer: C) Secure session cookie management
📌 Explanation: Proper cookie security prevents session hijacking rather than causing it.

32. How does enabling Content Security Policy (CSP) help prevent session hijacking?

A) By restricting which scripts can be executed in the browser
B) By blocking all JavaScript
C) By encrypting cookies at the database level
D) By forcing password changes every 24 hours

✅ Answer: A) By restricting which scripts can be executed in the browser
📌 Explanation: CSP helps prevent XSS attacks, which are commonly used to steal session cookies.

33. What should happen when a user manually logs out?

A) The session should remain active for future logins
B) The session should be invalidated immediately
C) The session ID should be stored in local storage
D) The session timeout should reset to 24 hours

✅ Answer: B) The session should be invalidated immediately
📌 Explanation: Ensuring that sessions are destroyed upon logout prevents attackers from reusing them.

34. What is an attacker’s goal in performing a session sidejacking attack?

A) To steal user credentials
B) To modify server settings
C) To eavesdrop on unencrypted network traffic and capture session cookies
D) To install malware on the user’s device

✅ Answer: C) To eavesdrop on unencrypted network traffic and capture session cookies
📌 Explanation: Session sidejacking exploits unencrypted sessions by capturing cookies sent over HTTP.

35. What happens when a session is not invalidated properly after logout?

A) The session remains active and can be reused by an attacker
B) The user is automatically redirected to the homepage
C) The session gets automatically transferred to another device
D) The session is automatically encrypted

✅ Answer: A) The session remains active and can be reused by an attacker
📌 Explanation: If a session is not invalidated upon logout, an attacker who obtains the session token can continue accessing the account.

36. Which session management feature helps prevent an attacker from using a stolen session token indefinitely?

A) Session expiration and renewal
B) Allowing persistent sessions
C) Keeping session IDs short and predictable
D) Using only client-side authentication

✅ Answer: A) Session expiration and renewal
📌 Explanation: Expiring and regenerating session tokens at regular intervals reduces the chances of an attacker using a stolen session.

37. Which of the following HTTP headers helps prevent session hijacking?

A) Cache-Control: no-store
B) X-Frame-Options: SAMEORIGIN
C) Content-Disposition: attachment
D) Expires: -1

✅ Answer: A) Cache-Control: no-store
📌 Explanation: Cache-Control: no-store ensures that session tokens are not stored in the browser cache, reducing the risk of session hijacking.

38. Which attack exploits an authenticated user’s active session to perform unauthorized actions?

A) Cross-Site Request Forgery (CSRF)
B) SQL Injection
C) DNS Spoofing
D) Buffer Overflow

✅ Answer: A) Cross-Site Request Forgery (CSRF)
📌 Explanation: CSRF tricks an authenticated user into executing unwanted actions without their consent, often by leveraging an active session.

39. What should happen to a session when a user changes their password?

A) The session should persist for convenience
B) The session should be logged out and a new session should be issued
C) The session should be extended for another 24 hours
D) The session should not be affected

✅ Answer: B) The session should be logged out and a new session should be issued
📌 Explanation: Logging out active sessions when a user changes their password prevents attackers from using stolen session tokens.

40. What is the most effective way to prevent session hijacking over an untrusted network?

A) Using HTTP instead of HTTPS
B) Implementing session tokens in URL parameters
C) Enforcing the use of HTTPS and VPNs
D) Disabling session expiration

✅ Answer: C) Enforcing the use of HTTPS and VPNs
📌 Explanation: HTTPS encrypts session data, and VPNs provide additional security by encrypting all network traffic.

41. What is the best practice for storing session tokens in modern web applications?

A) Store them in browser local storage
B) Store them in session cookies with Secure and HttpOnly flags
C) Store them in JavaScript variables
D) Append them in every URL request

✅ Answer: B) Store them in session cookies with Secure and HttpOnly flags
📌 Explanation: Secure cookies ensure tokens are only sent over HTTPS, and HttpOnly prevents JavaScript from accessing them.

42. How does a SameSite cookie attribute help in preventing session hijacking?

A) It prevents the session cookie from being sent in cross-site requests
B) It encrypts the session ID on the server
C) It ensures the session ID is visible to JavaScript
D) It forces the user to re-authenticate every 30 seconds

✅ Answer: A) It prevents the session cookie from being sent in cross-site requests
📌 Explanation: SameSite cookies restrict cross-site requests, preventing CSRF attacks that exploit session tokens.

43. Why should web applications implement session timeout policies?

A) To improve site performance
B) To force users to log in repeatedly
C) To reduce the risk of stolen or hijacked sessions being used
D) To allow indefinite authentication

✅ Answer: C) To reduce the risk of stolen or hijacked sessions being used
📌 Explanation: Automatic session timeouts reduce the attack window for hijackers.

44. What security risk arises when developers store session IDs in JavaScript-accessible storage?

A) The session ID becomes inaccessible
B) It prevents session hijacking
C) It makes the session ID vulnerable to XSS attacks
D) It improves website performance

✅ Answer: C) It makes the session ID vulnerable to XSS attacks
📌 Explanation: XSS attacks can steal session IDs stored in JavaScript-accessible storage like localStorage.

45. Which of the following is a recommended way to protect session cookies?

A) Setting cookies with the Secure and HttpOnly attributes
B) Storing session IDs in HTML hidden fields
C) Keeping session cookies stored in the database
D) Allowing session cookies to be modified by JavaScript

✅ Answer: A) Setting cookies with the Secure and HttpOnly attributes
📌 Explanation: Secure cookies ensure they are only transmitted over HTTPS, and HttpOnly prevents JavaScript from accessing them.

46. How does an attacker exploit a session token in a man-in-the-middle attack?

A) By modifying server logs
B) By injecting a malicious SQL query
C) By intercepting an unencrypted session token over HTTP
D) By performing a CAPTCHA challenge

✅ Answer: C) By intercepting an unencrypted session token over HTTP
📌 Explanation: Attackers sniff unencrypted network traffic to capture and use session tokens.

47. What is the main purpose of implementing an access token with a short expiration time?

A) To increase session duration
B) To reduce the impact of session hijacking
C) To allow attackers easier access to sessions
D) To avoid using authentication altogether

✅ Answer: B) To reduce the impact of session hijacking
📌 Explanation: Short-lived tokens ensure that even if they are compromised, their usability period is limited.

48. What is the risk of allowing session persistence (Remember Me) without additional security?

A) It increases user engagement
B) It enables automatic session renewal
C) It allows attackers to steal long-lived session tokens
D) It reduces the risk of CSRF attacks

✅ Answer: C) It allows attackers to steal long-lived session tokens
📌 Explanation: Persistent sessions should be protected with re-authentication and expiration policies.

49. Which attack involves an attacker tricking a victim into using a pre-defined session ID?

A) SQL Injection
B) Session Fixation
C) Cross-Site Scripting (XSS)
D) DNS Spoofing

✅ Answer: B) Session Fixation
📌 Explanation: Session Fixation occurs when an attacker forces a victim to use a session ID the attacker controls.

50. Why should developers avoid using predictable session IDs?

A) To improve application speed
B) To prevent session ID brute-forcing
C) To make it easier for users to remember their session
D) To allow tracking of user activity

✅ Answer: B) To prevent session ID brute-forcing
📌 Explanation: Predictable session IDs allow attackers to guess and hijack valid sessions.

51. Why is it important to regenerate session IDs after authentication?

A) To prevent session fixation attacks
B) To improve application speed
C) To allow users to reuse session IDs
D) To allow attackers to predict session IDs

✅ Answer: A) To prevent session fixation attacks
📌 Explanation: Regenerating session IDs after login ensures that attackers cannot force a user to use a predetermined session ID.

52. Which security measure ensures that session cookies are not accessible via JavaScript?

A) Enabling Secure flag
B) Enabling HttpOnly flag
C) Using localStorage to store session data
D) Encrypting session cookies with Base64

✅ Answer: B) Enabling HttpOnly flag
📌 Explanation: The HttpOnly flag prevents JavaScript from accessing session cookies, reducing the risk of XSS attacks.

53. What is a secure alternative to session-based authentication?

A) Using plaintext credentials for every request
B) Implementing JWT (JSON Web Tokens)
C) Using only username-based authentication
D) Storing session tokens in URLs

✅ Answer: B) Implementing JWT (JSON Web Tokens)
📌 Explanation: JWTs provide stateless authentication without relying on traditional session-based mechanisms.

54. Why should session IDs never be included in URLs?

A) URLs are encrypted before being transmitted
B) URLs are visible in browser history, referrer headers, and server logs
C) URLs automatically expire after each session
D) Users find it easier to remember session IDs in URLs

✅ Answer: B) URLs are visible in browser history, referrer headers, and server logs
📌 Explanation: Storing session IDs in URLs exposes them to attackers through logs, history, and phishing attacks.

55. What happens when a session token is stolen and there is no session expiration?

A) The attacker has indefinite access to the victim’s account
B) The token self-destructs after 10 minutes
C) The user is notified immediately
D) The session token regenerates itself automatically

✅ Answer: A) The attacker has indefinite access to the victim’s account
📌 Explanation: Without expiration, session tokens remain valid indefinitely, increasing the risk of persistent account compromise.

56. Which type of attack exploits predictable session tokens?

A) Session brute-force attack
B) Man-in-the-Middle attack
C) Cross-Site Request Forgery (CSRF)
D) Clickjacking

✅ Answer: A) Session brute-force attack
📌 Explanation: Attackers use brute-force methods to guess weak or predictable session tokens.

57. How does an attacker perform a sidejacking attack?

A) By resetting the user’s password
B) By sniffing unencrypted session cookies over public Wi-Fi
C) By injecting malware into a website
D) By using biometric authentication

✅ Answer: B) By sniffing unencrypted session cookies over public Wi-Fi
📌 Explanation: Sidejacking involves intercepting unencrypted session tokens to hijack user sessions.

58. What is the purpose of setting the “Secure” flag on session cookies?

A) To encrypt the cookie contents
B) To ensure the cookie is only sent over HTTPS
C) To make cookies accessible to JavaScript
D) To allow the session to persist longer

✅ Answer: B) To ensure the cookie is only sent over HTTPS
📌 Explanation: The Secure flag prevents cookies from being transmitted over unencrypted HTTP connections.

59. Which security control helps prevent an attacker from using a stolen session cookie on a different device?

A) Device fingerprinting
B) Keeping sessions active indefinitely
C) Storing session tokens in the database
D) Allowing multiple concurrent sessions

✅ Answer: A) Device fingerprinting
📌 Explanation: Device fingerprinting detects changes in user environments, helping to detect and block unauthorized session reuse.

60. Which of the following is NOT a best practice for secure session management?

A) Using strong, random session IDs
B) Allowing session persistence without additional authentication
C) Regenerating session IDs after login
D) Implementing session expiration and inactivity timeouts

✅ Answer: B) Allowing session persistence without additional authentication
📌 Explanation: Persistent sessions without re-authentication increase the risk of session hijacking.

61. How does a web application confirm a session is still valid?

A) By asking users to re-enter their password every 5 minutes
B) By validating the session ID against the server’s session store
C) By logging the user out immediately after login
D) By encrypting all session IDs using MD5

✅ Answer: B) By validating the session ID against the server’s session store
📌 Explanation: The server checks if a session ID exists and is valid before allowing access.

62. Why should session tokens be stored in cookies rather than localStorage?

A) Cookies are more readable
B) Cookies can be secured using HttpOnly and Secure attributes
C) LocalStorage is more secure than cookies
D) Cookies expire faster than localStorage

✅ Answer: B) Cookies can be secured using HttpOnly and Secure attributes
📌 Explanation: Cookies provide better security mechanisms compared to localStorage, which is vulnerable to XSS attacks.

63. What is an effective countermeasure against session replay attacks?

A) Using CAPTCHAs on login forms
B) Implementing session tokens with one-time use
C) Allowing session tokens to be reused across different IPs
D) Disabling HTTPS

✅ Answer: B) Implementing session tokens with one-time use
📌 Explanation: One-time session tokens prevent attackers from reusing stolen session data.

64. Which attack involves forcing a user to send an unwanted request using their active session?

A) Cross-Site Request Forgery (CSRF)
B) Cross-Site Scripting (XSS)
C) Session Sidejacking
D) DNS Spoofing

✅ Answer: A) Cross-Site Request Forgery (CSRF)
📌 Explanation: CSRF exploits an active session to perform unauthorized actions on behalf of a user.

65. What is the impact of session hijacking?

A) Unauthorized access to user accounts
B) Faster website performance
C) Improved session reliability
D) Secure user authentication

✅ Answer: A) Unauthorized access to user accounts
📌 Explanation: Session hijacking allows attackers to impersonate users, leading to account takeover.

66. Which of the following is an example of poor session management?

A) Logging out all active sessions upon password change
B) Storing session tokens in URL parameters
C) Using HTTPS for session transmission
D) Implementing multi-factor authentication

✅ Answer: B) Storing session tokens in URL parameters
📌 Explanation: Storing session IDs in URLs exposes them to interception and replay attacks.

67. Which attack technique can be used to steal a session ID over an unsecured network?

A) Packet sniffing
B) URL redirection
C) Phishing
D) Brute-force login

✅ Answer: A) Packet sniffing
📌 Explanation: Packet sniffing allows attackers to capture unencrypted session data.

68. What is an important consideration when implementing “Remember Me” functionality?

A) Using long-lived session tokens with re-authentication requirements
B) Keeping session tokens active indefinitely
C) Storing passwords in plaintext for easier access
D) Allowing session reuse without any verification

✅ Answer: A) Using long-lived session tokens with re-authentication requirements
📌 Explanation: Secure “Remember Me” features require re-authentication for high-risk actions.

69. Why should session IDs not be reused after logout?

A) To prevent session fixation and hijacking
B) To improve authentication speed
C) To allow users to log in faster
D) To track user activity

✅ Answer: A) To prevent session fixation and hijacking
📌 Explanation: Reusing session IDs increases the risk of attackers reactivating old sessions.

70. What should happen if a user logs in from a new device?

A) The session should be invalidated on other devices
B) The session should persist across all devices
C) The user should be automatically logged out
D) The session should expire after 5 minutes

✅ Answer: A) The session should be invalidated on other devices
📌 Explanation: Invalidating old sessions prevents attackers from maintaining access.

71. What should a web application do when it detects a session hijacking attempt?

A) Ignore the suspicious activity
B) Extend the session duration
C) Immediately terminate the active session and prompt for re-authentication
D) Allow the session to continue until manually logged out

✅ Answer: C) Immediately terminate the active session and prompt for re-authentication
📌 Explanation: Terminating the compromised session prevents an attacker from continuing unauthorized access.

72. What is a key characteristic of a secure session ID?

A) It is short and human-readable
B) It remains constant for a user
C) It is long, randomly generated, and unpredictable
D) It is manually assigned by the administrator

✅ Answer: C) It is long, randomly generated, and unpredictable
📌 Explanation: Secure session IDs should be unique and difficult to predict to prevent brute-force attacks.

73. How does browser session storage impact session security?

A) It enhances security by encrypting session data
B) It allows JavaScript to access session data, making it vulnerable to XSS attacks
C) It prevents session hijacking by default
D) It ensures that session data is stored only on the server

✅ Answer: B) It allows JavaScript to access session data, making it vulnerable to XSS attacks
📌 Explanation: Session storage is susceptible to client-side attacks like XSS, making it an insecure way to store session IDs.

74. What is the role of an HMAC (Hashed Message Authentication Code) in session management?

A) It encrypts session tokens
B) It ensures the integrity and authenticity of session tokens
C) It increases session duration
D) It allows session sharing across multiple users

✅ Answer: B) It ensures the integrity and authenticity of session tokens
📌 Explanation: HMAC verifies that session tokens have not been tampered with by attackers.

75. Why should session cookies have a defined expiration time?

A) To prevent long-lived session hijacking
B) To force users to log in frequently
C) To reduce the risk of CSRF attacks
D) To allow unlimited access to applications

✅ Answer: A) To prevent long-lived session hijacking
📌 Explanation: Expiring session cookies limits the time attackers have to exploit a hijacked session.

76. What type of attack can be mitigated by using one-time session tokens?

A) SQL Injection
B) Session Replay Attacks
C) DNS Spoofing
D) Social Engineering

✅ Answer: B) Session Replay Attacks
📌 Explanation: One-time session tokens prevent attackers from reusing stolen session credentials.

77. How does a SameSite=Lax cookie policy help prevent session hijacking?

A) It blocks session cookies from being sent in cross-site requests unless they are top-level navigations
B) It encrypts cookies before storing them
C) It disables cookies when a user logs out
D) It ensures cookies expire immediately after use

✅ Answer: A) It blocks session cookies from being sent in cross-site requests unless they are top-level navigations
📌 Explanation: The SameSite=Lax setting helps prevent CSRF attacks by restricting cookie transmission in cross-site requests.

78. Which of the following is an example of poor session handling?

A) Implementing a session timeout for inactive users
B) Using session IDs that are predictable
C) Storing session cookies securely
D) Using TLS to encrypt session data

✅ Answer: B) Using session IDs that are predictable
📌 Explanation: Predictable session IDs make it easy for attackers to guess and hijack sessions.

79. What should a web application do if a session is detected as being used from two different IP addresses?

A) Automatically log out both users
B) Allow both users to continue using the session
C) Invalidate the session and prompt the user for re-authentication
D) Extend the session timeout

✅ Answer: C) Invalidate the session and prompt the user for re-authentication
📌 Explanation: Detecting session use from multiple IPs is often an indicator of session hijacking, requiring re-authentication.

80. How does session locking improve security?

A) It binds the session to a single device or browser
B) It forces session IDs to be stored in URLs
C) It allows multiple users to share the same session
D) It prevents users from logging out

✅ Answer: A) It binds the session to a single device or browser
📌 Explanation: Locking a session to a specific device or browser prevents attackers from using stolen session tokens elsewhere.

81. What is a critical drawback of storing session data on the client side?

A) It increases server load
B) It allows users to modify their session data
C) It requires extra password protection
D) It improves encryption

✅ Answer: B) It allows users to modify their session data
📌 Explanation: Client-side session storage can be manipulated by attackers, leading to privilege escalation or unauthorized access.

82. What is the benefit of enforcing session inactivity timeouts?

A) It forces users to stay logged in
B) It prevents inactive users from leaving their sessions open indefinitely
C) It improves website load times
D) It disables session encryption

✅ Answer: B) It prevents inactive users from leaving their sessions open indefinitely
📌 Explanation: Session inactivity timeouts help prevent session hijacking by automatically logging out idle users.

83. What should happen when a user logs in from an unrecognized device?

A) The session should be blocked or require additional authentication
B) The session should automatically transfer to the new device
C) The user should be logged out of all devices
D) The session ID should be sent via email

✅ Answer: A) The session should be blocked or require additional authentication
📌 Explanation: Multi-factor authentication or additional verification ensures that only the legitimate user can access the account.

84. What is an attacker’s primary goal in a session hijacking attack?

A) To reset the victim’s password
B) To gain unauthorized access to an active session
C) To delete the victim’s browser history
D) To improve website security

✅ Answer: B) To gain unauthorized access to an active session
📌 Explanation: Attackers hijack sessions to impersonate victims and access their accounts.

85. What happens if a web application does not invalidate session tokens after logout?

A) The session remains active and can be reused by an attacker
B) The user is redirected to a secure page
C) The session token is automatically regenerated
D) The user is forced to change their password

✅ Answer: A) The session remains active and can be reused by an attacker
📌 Explanation: Failing to invalidate sessions allows attackers to use stolen session tokens.

86. Why should authentication be required again before performing high-risk actions?

A) To improve website performance
B) To prevent unauthorized actions even if a session is hijacked
C) To allow session persistence
D) To reset the session expiration

✅ Answer: B) To prevent unauthorized actions even if a session is hijacked
📌 Explanation: Requiring authentication before critical actions like changing passwords reduces the impact of session hijacking.

87. How can organizations detect session hijacking attempts in real-time?

A) By monitoring session anomalies such as IP or device changes
B) By allowing multiple sessions per user
C) By increasing session duration
D) By storing session data in client-side storage

✅ Answer: A) By monitoring session anomalies such as IP or device changes
📌 Explanation: Detecting unusual session activity can help identify and mitigate hijacking attempts.

88. What is the primary function of a Web Application Firewall (WAF) in session security?

A) To block malicious session hijacking attempts
B) To encrypt session IDs stored in JavaScript
C) To store session IDs in cookies
D) To allow multiple active sessions per user

✅ Answer: A) To block malicious session hijacking attempts
📌 Explanation: WAFs can detect and block session hijacking attempts based on abnormal session behaviors.

89. How can session token reuse be prevented?

A) By issuing new tokens for each session
B) By using the same session ID for all users
C) By allowing token reuse across devices
D) By disabling session expiration

✅ Answer: A) By issuing new tokens for each session
📌 Explanation: Generating new tokens prevents attackers from reusing old session IDs.

90. Why is logging out important in session security?

A) It terminates active sessions and prevents hijacking
B) It slows down attackers
C) It increases session expiration time
D) It prevents users from logging back in

✅ Answer: A) It terminates active sessions and prevents hijacking
📌 Explanation: Logging out ensures that session tokens become invalid, reducing the risk of hijacking.

91. What is the best way to prevent session fixation attacks?

A) Using the same session ID for a user across multiple logins
B) Allowing session IDs to be set manually by users
C) Regenerating the session ID after login
D) Storing session IDs in the browser’s local storage

✅ Answer: C) Regenerating the session ID after login
📌 Explanation: Regenerating the session ID upon authentication prevents attackers from forcing users into a fixed session ID.

92. What is an effective method to detect session hijacking attempts?

A) Monitoring session access patterns for anomalies
B) Allowing unlimited session duration
C) Using session tokens with weak entropy
D) Disabling session expiration

✅ Answer: A) Monitoring session access patterns for anomalies
📌 Explanation: Tracking login activity, IP changes, and user behavior helps detect potential session hijacking.

93. What should happen to a session token after a user logs out?

A) The session should remain active for 30 minutes
B) The session token should be invalidated immediately
C) The session should persist for better user experience
D) The session should be stored in browser history

✅ Answer: B) The session token should be invalidated immediately
📌 Explanation: Invalidating session tokens prevents attackers from reusing them after logout.

94. Which authentication mechanism can reduce the impact of session hijacking?

A) CAPTCHA
B) Two-Factor Authentication (2FA)
C) Using static session IDs
D) Keeping session tokens valid indefinitely

✅ Answer: B) Two-Factor Authentication (2FA)
📌 Explanation: 2FA adds an extra security layer, requiring attackers to bypass an additional authentication step.

95. How can an attacker exploit an active session in a Clickjacking attack?

A) By forcing the victim to interact with a hidden malicious frame
B) By directly modifying the session ID in a database
C) By stealing session cookies via DNS poisoning
D) By brute-forcing session IDs

✅ Answer: A) By forcing the victim to interact with a hidden malicious frame
📌 Explanation: Clickjacking tricks users into performing unintended actions while their session is active.

96. What is the benefit of implementing session revocation?

A) It allows users to switch between devices easily
B) It enables administrators to terminate compromised sessions immediately
C) It increases session lifetime
D) It improves website loading speed

✅ Answer: B) It enables administrators to terminate compromised sessions immediately
📌 Explanation: Session revocation ensures that compromised sessions are invalidated quickly, preventing unauthorized access.

97. What is the role of a session timeout warning in security?

A) It reminds users that their session will expire soon
B) It forces users to log out immediately
C) It disables authentication mechanisms
D) It allows attackers to extend session duration

✅ Answer: A) It reminds users that their session will expire soon
📌 Explanation: A session timeout warning alerts users about upcoming expiration, allowing them to extend their session securely if needed.

98. Why should session IDs be unique for each login session?

A) To prevent session hijacking and session replay attacks
B) To make it easier for users to remember their session IDs
C) To enable users to share session IDs securely
D) To improve browser caching

✅ Answer: A) To prevent session hijacking and session replay attacks
📌 Explanation: Unique session IDs prevent attackers from reusing old session tokens to gain unauthorized access.

99. What should a web application do if it detects multiple simultaneous logins from different locations?

A) Block all sessions and require re-authentication
B) Allow both sessions to continue for convenience
C) Disable all session expiration settings
D) Store session data in local storage for security

✅ Answer: A) Block all sessions and require re-authentication
📌 Explanation: Detecting simultaneous logins from different locations can indicate session hijacking, requiring additional verification.

100. What attack occurs when an attacker intercepts session tokens over an unencrypted network?

A) Session Sidejacking
B) SQL Injection
C) Cross-Site Scripting (XSS)
D) Brute-force attack

✅ Answer: A) Session Sidejacking
📌 Explanation: Session sidejacking occurs when an attacker captures session tokens transmitted over an unencrypted connection.

101. How does enforcing device-based authentication help prevent session hijacking?

A) It binds the session to a specific device, blocking unauthorized access
B) It disables session expiration settings
C) It allows users to log in from multiple devices simultaneously
D) It reduces the need for strong passwords

✅ Answer: A) It binds the session to a specific device, blocking unauthorized access
📌 Explanation: Device-based authentication ensures that only the authorized device can access a session.

102. How can using short-lived access tokens improve session security?

A) By limiting the time an attacker has to use a stolen token
B) By making session hijacking easier
C) By disabling HTTPS
D) By allowing unlimited session persistence

✅ Answer: A) By limiting the time an attacker has to use a stolen token
📌 Explanation: Short-lived tokens reduce the risk of long-term unauthorized access.

103. Which of the following is NOT a secure practice in session management?

A) Storing session IDs in URLs
B) Using session tokens with high entropy
C) Implementing automatic session expiration
D) Regenerating session tokens after authentication

✅ Answer: A) Storing session IDs in URLs
📌 Explanation: Storing session IDs in URLs exposes them to interception and session hijacking attacks.

104. What is the primary function of session timeout policies?

A) To automatically log out inactive users
B) To increase user engagement
C) To allow longer session persistence
D) To improve application performance

✅ Answer: A) To automatically log out inactive users
📌 Explanation: Session timeouts help prevent unauthorized access by closing inactive sessions.

105. What is the purpose of requiring CAPTCHA after multiple failed login attempts?

A) To prevent automated brute-force attacks
B) To make authentication harder for users
C) To allow session persistence
D) To increase session duration

✅ Answer: A) To prevent automated brute-force attacks
📌 Explanation: CAPTCHA prevents bots from attempting unlimited login attempts.

106. What is a security risk of allowing users to stay logged in indefinitely?

A) Attackers can hijack persistent sessions more easily
B) It improves authentication security
C) It forces users to change their passwords frequently
D) It reduces the risk of CSRF attacks

✅ Answer: A) Attackers can hijack persistent sessions more easily
📌 Explanation: Persistent sessions increase the window of opportunity for session hijacking.

107. What should happen if a session ID is detected in a URL request?

A) The session should be invalidated immediately
B) The session should be extended
C) The user should be redirected to the login page without an error message
D) The session ID should be stored in cookies

✅ Answer: A) The session should be invalidated immediately
📌 Explanation: Session IDs in URLs expose them to attackers and should be invalidated to prevent exploitation.

108. What is the best way to prevent session theft over public Wi-Fi?

A) Using a VPN and HTTPS
B) Keeping sessions active indefinitely
C) Allowing users to disable authentication
D) Storing session tokens in local storage

✅ Answer: A) Using a VPN and HTTPS
📌 Explanation: VPNs encrypt network traffic, and HTTPS secures session data in transit.

109. What should a user do if they suspect session hijacking?

A) Log out and reset their password
B) Keep using the session to monitor attacker activity
C) Share their session ID with customer support
D) Disable multi-factor authentication

✅ Answer: A) Log out and reset their password
📌 Explanation: Logging out and resetting credentials help protect against further unauthorized access.

110. How does HTTP Strict Transport Security (HSTS) enhance session security?

A) It forces all connections to use HTTPS, preventing session hijacking over HTTP
B) It disables user authentication
C) It stores session tokens in plain text
D) It allows session IDs to be stored in JavaScript

✅ Answer: A) It forces all connections to use HTTPS, preventing session hijacking over HTTP
📌 Explanation: HSTS ensures that browsers only connect securely to a website.

111. Why is it important to log session activity in security monitoring systems?

A) To track and detect unauthorized access attempts
B) To store user passwords securely
C) To increase session expiration time
D) To allow users to reuse session IDs

✅ Answer: A) To track and detect unauthorized access attempts
📌 Explanation: Logging session activity helps identify suspicious behavior and mitigate potential hijacking attempts.

112. How does implementing IP whitelisting enhance session security?

A) It restricts session access to pre-approved IP addresses
B) It allows unrestricted session sharing across multiple devices
C) It stores session tokens in plaintext for easy retrieval
D) It forces users to disable two-factor authentication

✅ Answer: A) It restricts session access to pre-approved IP addresses
📌 Explanation: IP whitelisting ensures that only authorized IPs can use a session, reducing the risk of hijacking.

113. What is the main advantage of using ephemeral (short-lived) session tokens?

A) They reduce the time attackers can use stolen session tokens
B) They improve web page loading speed
C) They prevent all XSS attacks
D) They allow session sharing between multiple users

✅ Answer: A) They reduce the time attackers can use stolen session tokens
📌 Explanation: Short-lived tokens minimize the impact of stolen session data by frequently regenerating tokens.

114. Why is it important to monitor failed session validation attempts?

A) To detect brute-force session hijacking attempts
B) To slow down web application performance
C) To allow session reuse across multiple browsers
D) To disable session expiration settings

✅ Answer: A) To detect brute-force session hijacking attempts
📌 Explanation: Repeated failed session validation attempts can indicate an attacker attempting to hijack a session.

115. What does the “Sliding Session Expiration” mechanism do?

A) Extends the session expiration time with continued activity
B) Forces users to re-authenticate every 30 seconds
C) Stores session IDs in local storage
D) Prevents session termination upon user logout

✅ Answer: A) Extends the session expiration time with continued activity
📌 Explanation: Sliding session expiration prolongs the session for active users while expiring inactive sessions.

116. How can token binding improve session security?

A) It associates session tokens with a specific client device
B) It encrypts session IDs using SHA-256
C) It allows session tokens to persist indefinitely
D) It forces session tokens to be stored in browser cache

✅ Answer: A) It associates session tokens with a specific client device
📌 Explanation: Token binding ties a session token to a particular device, preventing reuse on other devices.

117. Which security mechanism prevents session hijacking in an HTTP request?

A) Cross-Origin Resource Sharing (CORS)
B) Content Security Policy (CSP)
C) Transport Layer Security (TLS)
D) Browser caching

✅ Answer: C) Transport Layer Security (TLS)
📌 Explanation: TLS encrypts HTTP requests, preventing attackers from intercepting and stealing session tokens.

118. What is a session replay attack?

A) An attack where an attacker intercepts and reuses a valid session token
B) A brute-force attack on session credentials
C) A technique for increasing session expiration time
D) A method to automatically log users out

✅ Answer: A) An attack where an attacker intercepts and reuses a valid session token
📌 Explanation: In session replay attacks, an attacker captures a valid session token and reuses it to impersonate the victim.

119. Which of the following techniques enhances session security in Single Page Applications (SPAs)?

A) Using short-lived access tokens and refresh tokens
B) Storing session tokens in local storage
C) Keeping session tokens in URL parameters
D) Using session tokens with static values

✅ Answer: A) Using short-lived access tokens and refresh tokens
📌 Explanation: SPAs should use short-lived tokens and refresh mechanisms to enhance security.

120. What happens if an application fails to implement session invalidation on logout?

A) The session remains active and can be hijacked
B) The user is logged out securely
C) The session token regenerates automatically
D) The session token gets encrypted

✅ Answer: A) The session remains active and can be hijacked
📌 Explanation: Without session invalidation, attackers can reuse stolen session tokens.

121. Why is it recommended to implement session expiration in financial applications?

A) To reduce the risk of session hijacking and unauthorized transactions
B) To allow users to stay logged in indefinitely
C) To improve website performance
D) To allow easier password recovery

✅ Answer: A) To reduce the risk of session hijacking and unauthorized transactions
📌 Explanation: Financial applications require strict session controls to protect user accounts.

122. What is the recommended action when an inactive session expires?

A) Redirect the user to the login page
B) Keep the session active for another 10 minutes
C) Allow session re-use
D) Store session credentials in local storage

✅ Answer: A) Redirect the user to the login page
📌 Explanation: Expired sessions should be securely terminated, and users should be required to log in again.

123. How does implementing refresh tokens improve session security?

A) They allow sessions to persist longer while ensuring authentication validity
B) They prevent all types of XSS attacks
C) They allow users to log in without authentication
D) They disable session expiration

✅ Answer: A) They allow sessions to persist longer while ensuring authentication validity
📌 Explanation: Refresh tokens help renew sessions securely without exposing access tokens for extended periods.

124. Why should applications avoid storing session credentials in browser cache?

A) Cached session tokens can be stolen by attackers
B) It improves user experience
C) It allows session reuse across different browsers
D) It enhances password security

✅ Answer: A) Cached session tokens can be stolen by attackers
📌 Explanation: Storing session credentials in browser cache can expose them to unauthorized access.

125. What does “Idle Session Timeout” mean?

A) A session expires after a period of inactivity
B) A session persists indefinitely
C) A session expires based on server load
D) A session refreshes every minute

✅ Answer: A) A session expires after a period of inactivity
📌 Explanation: Idle session timeout automatically logs out users who remain inactive for a set duration.

126. How does rotating session tokens improve security?

A) It frequently changes session identifiers to prevent reuse
B) It allows users to share sessions
C) It improves password security
D) It increases session duration

✅ Answer: A) It frequently changes session identifiers to prevent reuse
📌 Explanation: Token rotation makes it harder for attackers to hijack sessions by frequently changing session IDs.

127. What is an effective countermeasure against cookie theft via JavaScript?

A) Setting the HttpOnly flag on cookies
B) Storing cookies in local storage
C) Allowing JavaScript access to session tokens
D) Using URL-based session management

✅ Answer: A) Setting the HttpOnly flag on cookies
📌 Explanation: The HttpOnly flag prevents JavaScript from accessing cookies, reducing XSS attack risks.

128. How does logging all user session activity improve security?

A) It helps detect anomalies and unauthorized access attempts
B) It slows down authentication processes
C) It prevents session expiration
D) It allows session reuse

✅ Answer: A) It helps detect anomalies and unauthorized access attempts
📌 Explanation: Logging user sessions helps identify suspicious activity and respond to security incidents.

129. How does multi-factor authentication (MFA) help in preventing session hijacking?

A) It requires additional verification even if the session token is stolen
B) It prevents session expiration
C) It allows unlimited session persistence
D) It replaces session management completely

✅ Answer: A) It requires additional verification even if the session token is stolen
📌 Explanation: MFA ensures that attackers cannot access a session without an additional authentication factor.

130. What is a primary risk of allowing multiple concurrent sessions per user?

A) It increases the likelihood of session hijacking
B) It enhances security by keeping users logged in
C) It disables session expiration
D) It prevents XSS attacks

✅ Answer: A) It increases the likelihood of session hijacking
📌 Explanation: Allowing multiple active sessions increases the attack surface, making it easier for attackers to hijack sessions.

131. How can a web application enforce session expiration upon user logout?

A) By clearing the session ID on the client and invalidating it on the server
B) By storing session tokens in local storage
C) By encrypting session tokens with a weak cipher
D) By keeping session tokens valid for future logins

✅ Answer: A) By clearing the session ID on the client and invalidating it on the server
📌 Explanation: Ensuring both client and server invalidate session tokens prevents unauthorized reuse.

132. Which of the following is a key principle in secure session management?

A) Assigning static session IDs to users
B) Using randomly generated and unpredictable session IDs
C) Allowing session persistence without security measures
D) Keeping session tokens in plaintext

✅ Answer: B) Using randomly generated and unpredictable session IDs
📌 Explanation: Secure session IDs should be long, unique, and difficult to predict.

133. What does enforcing a “One Session Per User” policy help prevent?

A) Session hijacking and simultaneous unauthorized logins
B) Faster website performance
C) Increased memory consumption
D) Increased phishing attempts

✅ Answer: A) Session hijacking and simultaneous unauthorized logins
📌 Explanation: Limiting users to one session at a time reduces the risk of session hijacking.

134. Why should session tokens never be stored in browser cache?

A) They can be accessed by attackers through local file access
B) They increase authentication speed
C) They prevent users from logging out
D) They improve session persistence

✅ Answer: A) They can be accessed by attackers through local file access
📌 Explanation: Storing session tokens in browser cache increases the risk of theft if the system is compromised.

135. What is an essential security measure for session management in a shared computer environment?

A) Automatically logging out inactive users
B) Allowing session persistence
C) Storing session credentials in local storage
D) Allowing users to manually save their session IDs

✅ Answer: A) Automatically logging out inactive users
📌 Explanation: Auto-logout helps prevent unauthorized access in shared environments.

136. Which session security measure reduces the risk of session fixation attacks?

A) Regenerating session IDs after authentication
B) Allowing session IDs to persist across multiple logins
C) Storing session IDs in plaintext
D) Using fixed session tokens

✅ Answer: A) Regenerating session IDs after authentication
📌 Explanation: Regenerating session IDs prevents attackers from forcing users into known session IDs.

137. Why should session IDs be transmitted only over HTTPS?

A) To prevent interception by attackers using network sniffing tools
B) To make session management more complex
C) To prevent users from logging out
D) To store session data in plaintext

✅ Answer: A) To prevent interception by attackers using network sniffing tools
📌 Explanation: HTTPS encrypts session data, making it difficult for attackers to capture session tokens.

138. Which of the following increases the risk of session hijacking?

A) Using session tokens stored in cookies with Secure and HttpOnly flags
B) Allowing session persistence without expiration
C) Using short-lived session tokens
D) Enforcing multi-factor authentication

✅ Answer: B) Allowing session persistence without expiration
📌 Explanation: Persistent sessions without expiration increase the time attackers have to hijack a session.

139. What is the purpose of using session token encryption?

A) To prevent unauthorized modification and reuse of session tokens
B) To increase token predictability
C) To allow session tokens to be stored in URLs
D) To ensure session tokens can be easily accessed by JavaScript

✅ Answer: A) To prevent unauthorized modification and reuse of session tokens
📌 Explanation: Encrypting session tokens ensures their integrity and prevents attackers from forging tokens.

140. Which of the following is an example of improper session termination?

A) Logging the user out but keeping their session token valid
B) Invalidating session tokens after logout
C) Clearing session cookies upon logout
D) Destroying server-side session data upon user logout

✅ Answer: A) Logging the user out but keeping their session token valid
📌 Explanation: If session tokens remain valid after logout, attackers can reuse them for unauthorized access.

141. How does enforcing periodic re-authentication improve session security?

A) It ensures the user is still legitimate during extended sessions
B) It prevents all phishing attacks
C) It allows session tokens to be stored in URLs
D) It disables multi-factor authentication

✅ Answer: A) It ensures the user is still legitimate during extended sessions
📌 Explanation: Periodic re-authentication helps verify that the session is still being used by the rightful owner.

142. What is a best practice for securing session storage in mobile applications?

A) Using Secure Enclaves or Keychain for sensitive session data
B) Storing session tokens in local storage
C) Keeping session tokens in plaintext files
D) Allowing session tokens to persist indefinitely

✅ Answer: A) Using Secure Enclaves or Keychain for sensitive session data
📌 Explanation: Secure Enclaves and Keychain provide protected storage for sensitive information.

143. What is a major weakness of using static session tokens?

A) They can be reused indefinitely if stolen
B) They provide better security than rotating session tokens
C) They prevent session hijacking
D) They improve authentication performance

✅ Answer: A) They can be reused indefinitely if stolen
📌 Explanation: Static session tokens allow attackers to reuse them without restriction.

144. What role do session cookies play in preventing unauthorized access?

A) They store authentication information temporarily
B) They allow multiple users to share the same session
C) They prevent encryption of session tokens
D) They disable secure authentication mechanisms

✅ Answer: A) They store authentication information temporarily
📌 Explanation: Session cookies store authentication details securely for a limited time.

145. How can developers prevent Cross-Site Script Inclusion (XSSI) attacks on session management?

A) By setting appropriate Content Security Policy (CSP) headers
B) By storing session IDs in URLs
C) By disabling all authentication mechanisms
D) By allowing session IDs to be accessed via JavaScript

✅ Answer: A) By setting appropriate Content Security Policy (CSP) headers
📌 Explanation: CSP headers help prevent unauthorized execution of scripts that could steal session tokens.

146. What is an effective way to prevent session hijacking over public networks?

A) Using a VPN along with HTTPS encryption
B) Storing session credentials in local storage
C) Allowing session tokens to persist indefinitely
D) Using session IDs with predictable values

✅ Answer: A) Using a VPN along with HTTPS encryption
📌 Explanation: VPNs and HTTPS encryption protect session data from network-based attacks.

147. What should happen if a session is accessed from a new geographic location?

A) The user should be required to verify their identity
B) The session should persist without any security checks
C) The session ID should be stored in browser cache
D) The session should be shared between multiple users

✅ Answer: A) The user should be required to verify their identity
📌 Explanation: Verifying identity upon location change helps prevent unauthorized access.

148. What is a security concern with allowing multiple concurrent sessions?

A) It increases the attack surface for session hijacking
B) It improves website performance
C) It prevents CSRF attacks
D) It enhances session persistence

✅ Answer: A) It increases the attack surface for session hijacking
📌 Explanation: Multiple concurrent sessions provide attackers more opportunities to hijack an active session.

149. How does restricting session duration improve security?

A) It limits the time an attacker has to hijack a session
B) It makes login harder for users
C) It increases the risk of XSS attacks
D) It allows session tokens to be reused indefinitely

✅ Answer: A) It limits the time an attacker has to hijack a session
📌 Explanation: Short session durations reduce the time available for attackers to exploit stolen session tokens.

150. What is a potential risk of storing session data on the client side?

A) Users can tamper with session data
B) It prevents session hijacking
C) It enhances session expiration settings
D) It eliminates the need for authentication

✅ Answer: A) Users can tamper with session data
📌 Explanation: Client-side storage allows attackers to modify session data, leading to security risks.

151. Why is it a bad practice to use predictable session IDs?

A) Attackers can easily guess and hijack sessions
B) It speeds up authentication
C) It improves session tracking
D) It reduces server resource usage

✅ Answer: A) Attackers can easily guess and hijack sessions
📌 Explanation: Predictable session IDs allow attackers to brute-force and take control of active sessions.

152. How can developers prevent session fixation attacks?

A) By regenerating the session ID upon user authentication
B) By allowing users to set their own session ID
C) By storing session IDs in local storage
D) By using static session tokens

✅ Answer: A) By regenerating the session ID upon user authentication
📌 Explanation: Regenerating the session ID prevents attackers from forcing a known session ID onto a victim.

153. What is an effective way to prevent session tokens from being stolen via browser extensions?

A) By setting the HttpOnly flag on cookies
B) By storing session tokens in local storage
C) By embedding session tokens in HTML forms
D) By disabling multi-factor authentication

✅ Answer: A) By setting the HttpOnly flag on cookies
📌 Explanation: The HttpOnly flag prevents JavaScript (including browser extensions) from accessing session cookies.

154. Why should session tokens be invalidated after a password reset?

A) To prevent attackers from using stolen session tokens
B) To improve website performance
C) To allow users to reuse their previous session
D) To extend the session duration

✅ Answer: A) To prevent attackers from using stolen session tokens
📌 Explanation: Invalidating all active sessions after a password reset ensures that compromised sessions are revoked.

155. Which authentication method makes session hijacking significantly harder?

A) Multi-Factor Authentication (MFA)
B) Using plain-text passwords
C) Allowing persistent logins
D) Storing session tokens in local storage

✅ Answer: A) Multi-Factor Authentication (MFA)
📌 Explanation: MFA adds an extra layer of security, preventing unauthorized access even if the session token is compromised.

156. What should happen if a session token is detected in a referrer header?

A) The session should be invalidated immediately
B) The session should be extended
C) The session token should be shared across devices
D) The session token should be stored in local storage

✅ Answer: A) The session should be invalidated immediately
📌 Explanation: Session tokens in referrer headers expose them to attackers, requiring immediate invalidation.

157. What is a major security risk of using third-party session management tools without proper security checks?

A) The tool may not enforce strong security measures, leading to session hijacking
B) The tool improves authentication security
C) It prevents all XSS attacks
D) It allows session reuse across multiple accounts

✅ Answer: A) The tool may not enforce strong security measures, leading to session hijacking
📌 Explanation: Third-party tools must be vetted for security to prevent vulnerabilities in session management.

158. How does implementing device-based authentication improve session security?

A) It restricts session use to authorized devices only
B) It allows session tokens to persist indefinitely
C) It prevents CAPTCHA challenges
D) It stores session IDs in local storage

✅ Answer: A) It restricts session use to authorized devices only
📌 Explanation: Device-based authentication ensures that a session is bound to a verified device, preventing unauthorized access.

159. Why should session tokens not be stored in browser local storage?

A) Local storage is vulnerable to Cross-Site Scripting (XSS) attacks
B) Local storage prevents session reuse
C) Local storage automatically encrypts session data
D) Local storage makes session management faster

✅ Answer: A) Local storage is vulnerable to Cross-Site Scripting (XSS) attacks
📌 Explanation: JavaScript can access local storage, making session tokens stored there susceptible to theft via XSS attacks.

160. What is the main disadvantage of using long-lived session tokens?

A) They increase the risk of session hijacking
B) They improve user convenience
C) They reduce authentication time
D) They prevent brute-force attacks

✅ Answer: A) They increase the risk of session hijacking
📌 Explanation: Long-lived tokens give attackers more time to exploit stolen session credentials.

161. How does restricting session usage to a single device at a time improve security?

A) It prevents session hijacking across multiple locations
B) It allows attackers to use session tokens more efficiently
C) It increases session duration
D) It disables HTTPS

✅ Answer: A) It prevents session hijacking across multiple locations
📌 Explanation: Restricting sessions to a single device prevents attackers from using stolen session tokens on another device.

162. What security risk arises from allowing session IDs to be stored in logs?

A) Attackers can retrieve and reuse session tokens from log files
B) It improves debugging
C) It speeds up authentication
D) It enables session persistence

✅ Answer: A) Attackers can retrieve and reuse session tokens from log files
📌 Explanation: Session IDs stored in logs can be accessed by attackers if the logs are not secured.

163. Why should session timeout policies be enforced based on user roles?

A) Higher-privileged users should have shorter session durations for better security
B) It makes authentication easier for all users
C) It allows longer session expiration times for all users
D) It disables user authentication

✅ Answer: A) Higher-privileged users should have shorter session durations for better security
📌 Explanation: Shorter session timeouts for privileged users reduce the risk of session hijacking.

164. What is a key advantage of rotating session tokens frequently?

A) It reduces the impact of session hijacking by invalidating stolen tokens
B) It allows session sharing
C) It prevents users from logging in
D) It increases session persistence

✅ Answer: A) It reduces the impact of session hijacking by invalidating stolen tokens
📌 Explanation: Frequent token rotation ensures that even if a token is stolen, it quickly becomes invalid.

165. What should a web application do if a session is accessed from two different geographic locations within a short time?

A) Prompt for re-authentication or block access
B) Extend the session duration
C) Allow concurrent access
D) Store session tokens in a cookie without security attributes

✅ Answer: A) Prompt for re-authentication or block access
📌 Explanation: Sudden location changes may indicate session hijacking, requiring re-authentication.

166. What is the risk of allowing unlimited session duration without re-authentication?

A) Attackers can maintain unauthorized access indefinitely
B) It improves security
C) It speeds up user authentication
D) It allows users to avoid using passwords

✅ Answer: A) Attackers can maintain unauthorized access indefinitely
📌 Explanation: Sessions without expiration make it easier for attackers to persist in compromised accounts.

167. How can web applications enforce secure logout mechanisms?

A) By immediately invalidating session tokens upon logout
B) By keeping session tokens active after logout
C) By storing session credentials in local storage
D) By allowing users to share session IDs

✅ Answer: A) By immediately invalidating session tokens upon logout
📌 Explanation: Secure logout ensures that attackers cannot reuse session tokens after the user logs out.

168. Why should session management logs be protected?

A) They may contain session IDs or authentication details that attackers can exploit
B) They slow down authentication
C) They prevent XSS attacks
D) They improve session persistence

✅ Answer: A) They may contain session IDs or authentication details that attackers can exploit
📌 Explanation: Logs should be protected to prevent unauthorized access to sensitive session data.

169. How does monitoring failed session validation attempts improve security?

A) It helps detect session hijacking attempts
B) It prevents XSS attacks
C) It speeds up user authentication
D) It disables CAPTCHA requirements

✅ Answer: A) It helps detect session hijacking attempts
📌 Explanation: Monitoring failed validation attempts helps detect attackers trying to use stolen session tokens.

170. What is an effective defense against replay attacks involving session tokens?

A) Using one-time session tokens
B) Allowing session reuse
C) Storing session IDs in local storage
D) Keeping session tokens active indefinitely

✅ Answer: A) Using one-time session tokens
📌 Explanation: One-time session tokens prevent attackers from reusing intercepted session credentials.

171. What is a primary security concern with using session identifiers in URL parameters?

A) They can be exposed in browser history and logs
B) They improve user experience
C) They allow multiple users to share a session
D) They increase session expiration time

✅ Answer: A) They can be exposed in browser history and logs
📌 Explanation: Storing session IDs in URLs makes them visible in logs, bookmarks, and browser history, increasing the risk of session hijacking.

172. How can implementing session expiration based on inactivity improve security?

A) It reduces the risk of unauthorized access when users leave their sessions open
B) It speeds up authentication processes
C) It increases session persistence
D) It allows session reuse

✅ Answer: A) It reduces the risk of unauthorized access when users leave their sessions open
📌 Explanation: Automatically expiring inactive sessions limits the time an attacker can exploit a hijacked session.

173. Which of the following can help detect session hijacking attempts?

A) Monitoring for session activity from different geographic locations within a short time
B) Allowing unlimited concurrent sessions
C) Storing session tokens in browser local storage
D) Using static session IDs

✅ Answer: A) Monitoring for session activity from different geographic locations within a short time
📌 Explanation: Detecting rapid geographic changes in session activity can indicate session hijacking.

174. What is an effective way to mitigate session hijacking over public Wi-Fi?

A) Using HTTPS and VPN
B) Storing session tokens in plaintext
C) Keeping session tokens in URL parameters
D) Disabling CAPTCHA challenges

✅ Answer: A) Using HTTPS and VPN
📌 Explanation: Encrypting session data with HTTPS and using a VPN prevents attackers from intercepting session tokens on public networks.

175. Why should a session be invalidated after an account password change?

A) To prevent unauthorized access from an old session
B) To extend session duration
C) To improve system performance
D) To allow concurrent logins

✅ Answer: A) To prevent unauthorized access from an old session
📌 Explanation: Invalidating sessions after a password change ensures that an attacker using a stolen session token cannot maintain access.

176. What is a risk of using session cookies without the `Secure` flag?

A) The cookie may be transmitted over an unencrypted HTTP connection
B) The cookie will not work on HTTPS
C) The cookie will expire too quickly
D) The user will be logged out automatically

✅ Answer: A) The cookie may be transmitted over an unencrypted HTTP connection
📌 Explanation: Without the Secure flag, session cookies can be sent over unencrypted HTTP connections, making them vulnerable to interception.

177. What is an effective way to prevent session hijacking via XSS attacks?

A) Using Content Security Policy (CSP) to restrict script execution
B) Storing session tokens in browser local storage
C) Allowing session IDs to be passed via query strings
D) Keeping session expiration indefinite

✅ Answer: A) Using Content Security Policy (CSP) to restrict script execution
📌 Explanation: CSP restricts which scripts can be executed, reducing the risk of XSS attacks stealing session tokens.

178. How does limiting session duration based on user roles enhance security?

A) High-privileged accounts have shorter sessions to reduce the risk of compromise
B) It allows all users to stay logged in indefinitely
C) It increases session persistence for all users
D) It prevents users from logging out

✅ Answer: A) High-privileged accounts have shorter sessions to reduce the risk of compromise
📌 Explanation: Limiting session duration for sensitive accounts reduces the risk of long-lived session hijacking.

179. What is a key advantage of session token rotation?

A) It invalidates stolen session tokens before an attacker can use them
B) It allows unlimited session persistence
C) It prevents brute-force login attempts
D) It disables multi-factor authentication

✅ Answer: A) It invalidates stolen session tokens before an attacker can use them
📌 Explanation: Rotating session tokens ensures that even if a session is hijacked, the stolen token quickly becomes useless.

180. What should a web application do when a user logs out?

A) Immediately invalidate the session token
B) Extend the session for another 24 hours
C) Store session credentials in local storage
D) Allow reusing the same session token

✅ Answer: A) Immediately invalidate the session token
📌 Explanation: Ensuring session invalidation upon logout prevents session reuse by attackers.

181. Why is using CAPTCHA not an effective solution for preventing session hijacking?

A) CAPTCHA prevents bot attacks but does not secure session tokens
B) CAPTCHA extends session duration
C) CAPTCHA allows multiple sessions
D) CAPTCHA encrypts session IDs

✅ Answer: A) CAPTCHA prevents bot attacks but does not secure session tokens
📌 Explanation: CAPTCHA prevents automated attacks but does not protect against session hijacking.

182. What is the role of a session timeout warning?

A) It notifies users when their session is about to expire, allowing them to extend it
B) It logs users out automatically without warning
C) It prevents XSS attacks
D) It disables session expiration

✅ Answer: A) It notifies users when their session is about to expire, allowing them to extend it
📌 Explanation: Timeout warnings help users maintain security while preventing session hijacking due to unattended sessions.

183. How can user-agent validation help detect session hijacking?

A) It verifies if the session is being accessed from a different browser or device
B) It allows session sharing
C) It disables session expiration
D) It extends session tokens indefinitely

✅ Answer: A) It verifies if the session is being accessed from a different browser or device
📌 Explanation: Changes in user-agent data can indicate unauthorized access attempts.

184. What is a major disadvantage of allowing multiple active sessions per user?

A) It increases the risk of session hijacking
B) It improves authentication security
C) It makes brute-force attacks impossible
D) It enhances password security

✅ Answer: A) It increases the risk of session hijacking
📌 Explanation: Multiple active sessions provide attackers with more opportunities to hijack a session.

185. How does enforcing re-authentication for high-risk actions improve security?

A) It ensures that an attacker cannot perform sensitive actions even if they hijack a session
B) It allows users to remain logged in indefinitely
C) It prevents session expiration
D) It speeds up authentication

✅ Answer: A) It ensures that an attacker cannot perform sensitive actions even if they hijack a session
📌 Explanation: Re-authentication prevents attackers from exploiting hijacked sessions to perform unauthorized actions.

186. What type of attack involves stealing session cookies via public Wi-Fi networks?

A) Session Sidejacking
B) SQL Injection
C) Clickjacking
D) Cross-Site Scripting (XSS)

✅ Answer: A) Session Sidejacking
📌 Explanation: Attackers use sniffing tools to capture session cookies transmitted over unencrypted public Wi-Fi.

187. How can an application enforce session security after login?

A) By regenerating the session token upon successful authentication
B) By storing session IDs in URL parameters
C) By keeping session IDs static
D) By extending session tokens indefinitely

✅ Answer: A) By regenerating the session token upon successful authentication
📌 Explanation: Token regeneration ensures that attackers cannot use a previously stolen session ID.

188. What is the primary goal of session management best practices?

A) To protect user sessions from hijacking and unauthorized access
B) To improve website speed
C) To allow multiple users to share a session
D) To disable password authentication

✅ Answer: A) To protect user sessions from hijacking and unauthorized access
📌 Explanation: Strong session management ensures user authentication and security.

189. Why should web applications log session termination events?

A) To detect unauthorized session terminations
B) To disable authentication mechanisms
C) To allow longer session duration
D) To prevent session expiration

✅ Answer: A) To detect unauthorized session terminations
📌 Explanation: Logging session terminations helps in auditing security events.

190. What is an effective countermeasure against session replay attacks?

A) Using time-bound and one-time session tokens
B) Allowing session reuse
C) Storing session tokens in local storage
D) Keeping session tokens valid indefinitely

✅ Answer: A) Using time-bound and one-time session tokens
📌 Explanation: One-time session tokens ensure attackers cannot reuse stolen tokens.

191. Why should applications enforce session expiration after a certain period of time?

A) To limit the time an attacker can use a stolen session token
B) To force users to log in frequently for no reason
C) To increase website speed
D) To allow session reuse

✅ Answer: A) To limit the time an attacker can use a stolen session token
📌 Explanation: Session expiration ensures that even if an attacker hijacks a session, the token will become invalid after a set period.

192. Which of the following is an example of weak session management?

A) Allowing session tokens to persist indefinitely
B) Regenerating session IDs upon authentication
C) Using HttpOnly and Secure flags on cookies
D) Implementing automatic session expiration

✅ Answer: A) Allowing session tokens to persist indefinitely
📌 Explanation: Persistent session tokens increase the risk of session hijacking and unauthorized access.

193. How can browser fingerprinting enhance session security?

A) By verifying session access based on device and browser characteristics
B) By storing session tokens in plaintext
C) By disabling multi-factor authentication
D) By allowing session IDs in URLs

✅ Answer: A) By verifying session access based on device and browser characteristics
📌 Explanation: Browser fingerprinting helps detect session hijacking by checking for changes in device, IP, and user-agent data.

194. What is an effective countermeasure against session fixation attacks?

A) Regenerating session IDs after authentication
B) Storing session tokens in local storage
C) Keeping the same session ID across all user sessions
D) Using static session tokens

✅ Answer: A) Regenerating session IDs after authentication
📌 Explanation: Changing session IDs upon login prevents attackers from forcing users into a known session ID.

195. What is the primary risk of using third-party authentication providers without proper validation?

A) Compromised authentication tokens can lead to session hijacking
B) It improves session security automatically
C) It prevents brute-force attacks
D) It disables multi-factor authentication

✅ Answer: A) Compromised authentication tokens can lead to session hijacking
📌 Explanation: If an attacker compromises an authentication provider, they can use stolen tokens to hijack user sessions.

196. What security mechanism ensures that session tokens are not reused by attackers?

A) Token expiration and rotation
B) Storing tokens in local storage
C) Allowing multiple concurrent sessions
D) Keeping session IDs in URL parameters

✅ Answer: A) Token expiration and rotation
📌 Explanation: Expiring and rotating tokens regularly ensures that even if a token is stolen, it becomes useless quickly.

197. Why should session tokens be encrypted when stored on the server?

A) To prevent unauthorized access if the database is compromised
B) To improve authentication speed
C) To allow session persistence
D) To reduce session expiration time

✅ Answer: A) To prevent unauthorized access if the database is compromised
📌 Explanation: Encrypting session tokens ensures that even if attackers gain access to the database, they cannot use the tokens.

198. What is a security risk of storing session tokens in JavaScript-accessible storage?

A) They can be stolen via Cross-Site Scripting (XSS) attacks
B) They improve session management
C) They prevent session hijacking
D) They increase encryption strength

✅ Answer: A) They can be stolen via Cross-Site Scripting (XSS) attacks
📌 Explanation: JavaScript-accessible storage (e.g., localStorage) is vulnerable to XSS attacks, exposing session tokens to attackers.

199. How does implementing short-lived session tokens improve security?

A) It reduces the window of opportunity for an attacker to hijack a session
B) It allows session tokens to persist longer
C) It prevents password expiration
D) It makes session hijacking easier

✅ Answer: A) It reduces the window of opportunity for an attacker to hijack a session
📌 Explanation: Short-lived tokens minimize the risk of attackers exploiting stolen session credentials.

200. How can an organization prevent unauthorized session access on shared or public computers?

A) By enforcing automatic session expiration and secure logout mechanisms
B) By storing session tokens in browser cache
C) By allowing session tokens to persist indefinitely
D) By disabling multi-factor authentication

✅ Answer: A) By enforcing automatic session expiration and secure logout mechanisms
📌 Explanation: Automatic session expiration and secure logout prevent attackers from hijacking an unattended session.

Weak Session Management – Session Hijacking & Fixes – MCQ Questions