CAS-003 · Question #924
CAS-003 Question #924: Real Exam Question with Answer & Explanation
The correct answer is C: The web application must set set-cookie secure.. The log entry likely shows a session hijacking attack-an attempt to steal or forge session cookies transmitted over an insecure channel. Two complementary protections address this: (C) The Secure flag on the Set-Cookie header ensures the cookie is only transmitted over HTTPS-encr
Question
Options
- ADisable the Windows location feature on the web server.
- BBlock port tcp'90 on the firewall.
- CThe web application must set set-cookie secure.
- DThe web application must configure tie cookie for HttpOnly
- EThe web application must blacklist the server 1.54.13.1
- FThe web application must clear the SameSite field in the cookie
Explanation
The log entry likely shows a session hijacking attack-an attempt to steal or forge session cookies transmitted over an insecure channel. Two complementary protections address this: (C) The Secure flag on the Set-Cookie header ensures the cookie is only transmitted over HTTPS-encrypted connections, preventing interception via man-in-the-middle or network sniffing on plaintext HTTP. (D) The HttpOnly flag prevents client-side JavaScript from accessing the cookie, blocking session token theft via Cross-Site Scripting (XSS) attacks where malicious script attempts document.cookie access. Together, these two flags protect session cookies from both transport-layer interception and client-side script theft. The other options are irrelevant: disabling a location feature (A) and blocking port 90 (B) don't address cookie security; blacklisting a single IP (E) is easily bypassed; clearing the SameSite field (F) would make the application less secure, not more.
Community Discussion
No community discussion yet for this question.