Access to which of the following is required to validate web session management?

Log timestamps record when events occurred but do not reveal the content or structure of session data necessary to assess session management controls.

Live session traffic captures network-level data in transit, but without examining the session state variables themselves, it is insufficient to fully validate how the application manages session state internally.

Session state variables directly reflect how the application manages session lifecycle, including session token generation, expiration, invalidation, and storage. Reviewing these variables allows a tester to verify that sessions are properly created upon authentication, securely maintained during interaction, and correctly destroyed upon logout, which are the core aspects of session management validation.

Test scripts are tools used to execute tests but are not the source of information needed to validate session management; they do not themselves contain the session state data under review.