112-52 · Question #111
Which of the following BEST helps prevent session hijacking?
The correct answer is A. Use of HTTPS instead of HTTP. HTTPS encrypts traffic between client and server, making it nearly impossible for an attacker to intercept and steal session tokens in transit - this is the primary defense against session hijacking. Changing network infrastructure (B) has no meaningful effect on session token…
Question
Which of the following BEST helps prevent session hijacking?
Options
- AUse of HTTPS instead of HTTP
- BChanging network infrastructure frequently
- CClearing browser cookies regularly
- DDisabling logging mechanisms
How the community answered
(53 responses)- A92% (49)
- B2% (1)
- C2% (1)
- D4% (2)
Explanation
HTTPS encrypts traffic between client and server, making it nearly impossible for an attacker to intercept and steal session tokens in transit - this is the primary defense against session hijacking. Changing network infrastructure (B) has no meaningful effect on session token security. Clearing cookies (C) removes sessions after the fact but does nothing to prevent theft while a session is active. Disabling logging (D) actually worsens security by eliminating your ability to detect attacks.
Memory tip: Think "HTTPS = Hidden Tokens, Protected Sessions." The S in HTTPS stands for Secure - and securing the channel is what keeps session tokens out of an attacker's hands.
Topics
Community Discussion
5
Mei-Ling H.Jan 11, 2026A is correct. HTTPS encrypts the entire session including the session token in transit, so an attacker sniffing the network cannot steal the token and impersonate the user, which is the exact attack session hijacking describes.
Ola B.Jan 14, 2026HTTPS locks down the wire, but if the server sets the cookie without the HttpOnly and Secure flags, an XSS payload or accidental HTTP downgrade can still hand that token to an attacker after it lands on the client, so getting both right is what actually closes the door.
Ola B.Jan 24, 2026I actually circled C first because I kept thinking about how session tokens live in cookies, so clearing them felt like a direct countermeasure. What snapped me out of it was setting up a quick lab with Wireshark and running plain HTTP traffic, because you can watch the session token fly across the wire in cleartext and grab it yourself in about two minutes. HTTPS encrypts that entire exchange in transit, so even if an attacker is sitting on the same network sniffing packets, they cannot read the token to hijack it. Clearing cookies after the fact does nothing for someone who already captured your token mid-session, which is why A is the answer that actually cuts the attack off before it starts.
Mateus R.Feb 9, 2026Think of cookies like car keys: HTTPS locks them in a vault during transit, which is exactly why A wins over the tempting-but-wrong cookie-clearing in C.
Mei-Ling H.Feb 11, 2026The vault analogy is good but it only covers transit, so pair it with HttpOnly to keep the keys away from any XSS that sneaks past the door.