Which features improve session security in web applications? (Choose two)

Question

Options

• AUse of short session expiration times
• BEncryption of session data
• CAllowing session reuse across multiple devices
• DHardcoding session tokens

• A
  70% (14)
• C
  20% (4)
• D
  10% (2)

Explanation

Short session expiration times (A) limit the window of opportunity for an attacker to hijack a stolen session token - once expired, the token is useless. Encrypting session data (B) ensures that even if session information is intercepted or accessed on the server, it cannot be read or tampered with in plaintext.

Why the distractors are wrong:

• C (session reuse across devices): Sharing a session across devices widens the attack surface - if one device is compromised, the session is compromised everywhere. Legitimate sessions should be tied to a single authenticated context.
• D (hardcoding session tokens): Hardcoded tokens are static, predictable, and easily discovered in source code or binaries - the opposite of secure. Session tokens must be dynamically generated and unpredictable.

Memory tip: Think "FRESH and SECRET" - sessions should expire quickly (fresh) and data should be encrypted (secret). Anything that makes a session permanent (D) or shareable (C) is a red flag.

No community discussion yet for this question.