If not properly secured, which of the following could result in the hijacking of HTTP traffic during a transaction between a user and a web application, allowing an attacker to impersonate the victim?

The correct answer is A. Session ID. Session IDs are unique tokens assigned by a web server to identify an authenticated user's session. If an attacker intercepts or steals a session ID (via packet sniffing, XSS, or man-in-the-middle attacks), they can present it to the server and impersonate the victim without…

Submitted by skyler.x· Apr 18, 2026Protection of Information Assets

Question

Options

ASession ID
BDevice ID
CServer ID
DApplication ID

How the community answered

(21 responses)

A
86% (18)
C
5% (1)
D
10% (2)

Explanation

Session IDs are unique tokens assigned by a web server to identify an authenticated user's session. If an attacker intercepts or steals a session ID (via packet sniffing, XSS, or man-in-the-middle attacks), they can present it to the server and impersonate the victim without needing credentials - this is known as session hijacking.

Why the distractors are wrong:

B. Device ID identifies a hardware device, not an active session; stealing it doesn't grant access to a live transaction.
C. Server ID identifies the server, not the user - an attacker can't impersonate a victim with it.
D. Application ID identifies the application itself, not an individual user's authenticated state.

Memory tip: Think of a session ID like a physical ticket stub at a concert - whoever holds it gets in, no questions asked. If someone pickpockets your stub mid-show, they can take your seat. Secure your ticket (session ID) with HTTPS and proper cookie flags (HttpOnly, Secure, SameSite) to prevent theft.

Topics

#Session Hijacking#Web Application Security#Authentication Security#HTTP Security

Community Discussion

No community discussion yet for this question.

Full CISA Practice