Which APM feature helps protect credentials against replay attacks?

Question

Options

• ACookie Encryption
• BSecure Session ID
• COne-Time Password
• DCSRF Token

• A
  7% (3)
• B
  88% (37)
• C
  2% (1)
• D
  2% (1)

Explanation

Secure Session ID (B) protects against replay attacks by generating a cryptographically unique, non-predictable session identifier for each authentication event. Because the session ID is invalidated after use or expiry, a captured token cannot be reused by an attacker - replaying it yields an expired or already-consumed session.

Cookie Encryption (A) is wrong because it only obscures cookie contents; an attacker can still capture and retransmit the full encrypted cookie without ever decrypting it - the server still accepts it.

One-Time Password (C) is a tempting choice since OTPs do prevent credential replay at the login stage, but within APM's feature set, it's Secure Session ID that specifically addresses post-authentication session-token replay, which is what this question targets.

CSRF Token (D) defends against Cross-Site Request Forgery - tricking a logged-in user's browser into making unauthorized requests - not against an attacker replaying stolen credentials or session tokens.

Memory tip: Think "replay = reuse of a session." A Secure Session ID makes each session ID a one-shot token at the session level - once it's used or expired, replaying it fails. Associate "secure session" with "can't reuse."

No community discussion yet for this question.