Annie has just succeeded in stealing a secure cookie via a XSS attack. She is able to replay the cookie even while the session is valid on the server. Why do you think this is possible?

Question

Options

• AAny cookie can be replayed irrespective of the session status
• BThe scenario is invalid as a secure cookie cannot be replayed
• CIt works because encryption is performed at the network layer (layer 1 encryption)
• DIt works because encryption is performed at the application layer (single encryption key)

• A
  13% (6)
• B
  8% (4)
• C
  4% (2)
• D
  75% (36)

No community discussion yet for this question.