Annie has just succeeded in stealing a secure cookie via a XSS attack. She is able to replay the cookie even while the session is invalid on the server. Why do you think this is possible?

Question

Options

• AIt works because encryption is performed at the application layer (single encryption key)
• BThe scenario is invalid as a secure cookie cannot be replayed
• CIt works because encryption is performed at the network layer (layer 1 encryption)
• DAny cookie can be replayed irrespective of the session status

• A
  81% (22)
• B
  4% (1)
• C
  11% (3)
• D
  4% (1)

No community discussion yet for this question.