I85PREP
⌘ K
CWICP study materials
CWICP study resources

CWICP practice questions

One question at a time. Build your CWICP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web Application Fundamentals and HTTP

A client sends an HTTP request for a resource and the origin server replies with status code 301. What does this status code indicate about the requested resource?

  1. The resource was found but the client must authenticate before access.
  2. The resource has been permanently moved to a new URI given in the Location header. Correct answer.
  3. The request was malformed and the server could not parse the message.
  4. The resource is temporarily available at a different URI that may change later.

Explanation

301 Moved Permanently signals that the target resource has a new permanent URI, and the server supplies that URI in the Location header. Clients and caches are expected to update stored references to the new location.

Question 2Web Application Fundamentals and HTTP

Which HTTP method is defined as safe and idempotent and is used to retrieve a representation of a target resource without changing server state?

  1. GET Correct answer.
  2. PUT
  3. POST
  4. PATCH

Explanation

GET is defined as safe and idempotent: it retrieves a representation and is not supposed to alter server state. Safe methods may still be logged, but they must not cause intended state changes.

Question 3Web Application Fundamentals and HTTP

A web application needs to keep a user's authenticated session across multiple requests. Which HTTP mechanism is designed to let the server store state on the client and have the client return it automatically?

  1. The Accept-Encoding request header
  2. A cookie set with the Set-Cookie response header Correct answer.
  3. An HTTP 204 response status
  4. The Referer request header

Explanation

Cookies are the standard HTTP state-management mechanism: the server sends Set-Cookie and the user agent returns the value in subsequent Cookie headers. This allows a session identifier to persist across otherwise stateless requests.

Question 4Web Application Fundamentals and HTTP

Which part of an HTTP URL identifies the host that should receive the request?

  1. The fragment identifier
  2. The authority component Correct answer.
  3. The path component
  4. The query string

Explanation

The authority component of a URI contains the host (and optional port and userinfo), which determines the server the request is sent to. The path, query, and fragment serve different roles.

Question 5Web Application Fundamentals and HTTP

An HTTP response includes the header Content-Type: application/json; charset=utf-8. What does this header tell the client?

  1. The media type of the response body and its character encoding. Correct answer.
  2. The length of the response body in bytes.
  3. The compression algorithm applied to the body.
  4. The cache lifetime of the response.

Explanation

Content-Type declares the media type of the representation and may include a charset parameter for text-based types. It does not describe length, caching, or compression.

Question 6Web Application Fundamentals and HTTP

During an HTTP/1.1 exchange, a client sends the request line GET /index.html HTTP/1.1. What is the correct order of the three parts shown?

  1. Method, target resource, protocol version Correct answer.
  2. Method, protocol version, target resource
  3. Target resource, protocol version, method
  4. Protocol version, method, target resource

Explanation

An HTTP/1.1 request line has the form method SP request-target SP HTTP-version. The method comes first, followed by the target and then the version token.

Question 7Web Application Fundamentals and HTTP

A browser loads a page over HTTPS, and the page contains a form that posts to an http:// URL. What does this mixed-content situation typically cause in a modern browser?

  1. The browser blocks or warns about the insecure submission because the page is secure. Correct answer.
  2. The submission proceeds silently with no security indication.
  3. The form submission is upgraded automatically to HTTPS without any warning.
  4. The browser downgrades the entire page to HTTP before submitting.

Explanation

Modern browsers treat active mixed content such as form submissions as a security risk and block it or present a warning. A secure origin must not silently send data over plaintext HTTP.

Question 8Web Application Fundamentals and HTTP

A developer wants to read the value of a query parameter named page from a request URL. Which component of the URL should be parsed for this value?

  1. The scheme
  2. The path
  3. The query string Correct answer.
  4. The fragment

Explanation

Query parameters follow the question mark in the query component of a URI, so page is parsed from that component. The path names the resource, the fragment is client-side, and the scheme names the protocol.

Question 9Web Application Fundamentals and HTTP

A server returns 200 OK with the header Cache-Control: no-store. How should a compliant cache treat this response?

  1. It may store the response but must revalidate it on every reuse.
  2. It may store the response for a default heuristic lifetime.
  3. It may store the response only if the request used GET.
  4. It must not store any part of the response. Correct answer.

Explanation

no-store instructs caches not to store the request or response at all, which is stronger than requiring revalidation. It is commonly used for sensitive data such as authenticated pages.

Question 10Web Application Fundamentals and HTTP

A client sends a request with the header If-None-Match: "abc123" and the current entity tag for the resource is "abc123". Assuming the resource is otherwise unchanged, which response should the server return?

  1. 409 Conflict
  2. 304 Not Modified with no message body Correct answer.
  3. 412 Precondition Failed
  4. 200 OK with the full representation

Explanation

If-None-Match is a conditional request: when the supplied entity tag matches the current one, the server responds 304 Not Modified and omits the body. This saves bandwidth during cache revalidation.

Question 11Web Application Fundamentals and HTTP

A REST API allows clients to update a resource by sending PUT /users/42 with a complete JSON body. Which property should this operation have according to HTTP semantics?

  1. It is non-idempotent because it modifies data.
  2. It is idempotent because repeating the same request yields the same resource state. Correct answer.
  3. It is safe because it targets an existing resource.
  4. It is cacheable by default in shared caches.

Explanation

PUT replaces the target resource with the enclosed representation, so repeating an identical request produces the same end state and is idempotent. Idempotency concerns repeated effects, not whether data changes.

Question 12Web Application Fundamentals and HTTP

A server responds with 401 Unauthorized and includes WWW-Authenticate: Basic realm="admin". What is the client expected to do next?

  1. Switch to the POST method and resubmit the body.
  2. Retry the request without credentials to see if access is public.
  3. Prompt for credentials and resend the request with an Authorization header. Correct answer.
  4. Follow the Location header to a login page.

Explanation

401 indicates missing or invalid authentication, and WWW-Authenticate describes the challenge scheme the client must satisfy. The client supplies credentials, here via HTTP Basic, in a subsequent Authorization header.

Question 13Web Application Fundamentals and HTTP

A response includes Set-Cookie: sid=abc; Secure; HttpOnly; SameSite=Lax. Which statement best describes the protections this cookie configuration provides?

  1. It is sent only over HTTPS, is inaccessible to JavaScript, and is restricted on cross-site requests. Correct answer.
  2. It prevents the cookie value from being modified by the user agent.
  3. It is encrypted at rest by the browser and readable only by the server.
  4. It is sent over both HTTP and HTTPS but blocked from cross-site requests.

Explanation

Secure limits transmission to secure channels, HttpOnly hides the cookie from document.cookie, and SameSite=Lax limits cross-site sending. Together they reduce interception, script theft, and cross-site request risks.

Question 14Web Application Fundamentals and HTTP

A web application accepts user input and reflects it into an HTML page without encoding. Which vulnerability class does this most directly create?

  1. Cross-site scripting Correct answer.
  2. Directory traversal
  3. Cross-site request forgery
  4. SQL injection

Explanation

Reflecting unencoded user input into HTML lets an attacker inject markup or script that executes in victims' browsers, which is cross-site scripting. Output encoding and a Content-Security-Policy are standard mitigations.

Question 15Web Application Fundamentals and HTTP

Which response header instructs the browser to restrict the origins from which scripts, styles, and other resources may be loaded?

  1. Content-Security-Policy Correct answer.
  2. X-Content-Type-Options
  3. Strict-Transport-Security
  4. Access-Control-Allow-Origin

Explanation

Content-Security-Policy defines an allowlist of sources for scripts, styles, images, and other resource types, mitigating injection attacks. The other headers address CORS, transport security, and MIME sniffing respectively.

Question 16Web Application Fundamentals and HTTP

A request uses Transfer-Encoding: chunked. What does this indicate about the message body?

  1. The body is compressed with the gzip coding.
  2. The body is omitted entirely from the message.
  3. The body length is declared in Content-Length in advance.
  4. The body is sent as a series of size-prefixed chunks terminated by a zero-length chunk. Correct answer.

Explanation

Chunked transfer coding sends the body in chunks, each preceded by its size in hexadecimal, and ends with a zero-length chunk. It is used when the total length is not known before transmission.

Question 17Web Application Fundamentals and HTTP

A client sends a request with the header Accept: text/html, application/json;q=0.9, */*;q=0.1. Which media type does this preference list rank highest?

  1. application/json
  2. All three are ranked equally
  3. */*
  4. text/html Correct answer.

Explanation

The q parameter expresses relative preference, and text/html has no q value, so it defaults to 1.0, higher than 0.9 for JSON and 0.1 for the wildcard. The server should prefer the highest-ranked acceptable type.

Question 18Web Application Fundamentals and HTTP

A server sends the response header Strict-Transport-Security: max-age=31536000; includeSubDomains. What effect does this have on the user agent?

  1. It blocks all cookies from being sent to the host.
  2. It disables HTTP/2 for the host for one year.
  3. It pins the server's TLS certificate for one year.
  4. It forces future requests to this host and its subdomains to use HTTPS for one year. Correct answer.

Explanation

HSTS tells the browser to treat the host as HTTPS-only for the max-age duration, and includeSubDomains extends that to subdomains. This prevents downgrade attacks and insecure first requests.

Question 19Web Application Fundamentals and HTTP

A web application behind a reverse proxy receives a request whose X-Forwarded-For header lists several addresses. Why should the application be cautious about trusting this header?

  1. The header is only valid for HTTPS requests.
  2. Clients can spoof the header unless the proxy strips and sets it reliably. Correct answer.
  3. The header replaces the Host header in HTTP/2.
  4. The header is encrypted and cannot be parsed by the application.

Explanation

X-Forwarded-For is a de facto header that any client can set, so a value is only trustworthy when a controlled proxy overwrites it. Trusting arbitrary client-supplied values can enable IP spoofing and access-control bypass.

Question 20Web Application Fundamentals and HTTP

A developer configures CORS on an API by returning Access-Control-Allow-Origin: * on responses to credentialed requests. What problem arises?

  1. The wildcard makes the response uncacheable by all caches.
  2. The wildcard forces the request to use the HEAD method.
  3. The wildcard disables TLS for the request.
  4. The wildcard cannot be combined with credentials, so the browser blocks the response. Correct answer.

Explanation

When credentials are included, the CORS specification forbids the wildcard origin, so the browser rejects the response. The server must echo a specific allowed origin and also send Access-Control-Allow-Credentials: true.

Question 21Web Application Fundamentals and HTTP

A response is served with Cache-Control: max-age=60, must-revalidate and the stored response is 90 seconds old. What must a compliant cache do before reusing it?

  1. Delete it permanently and never store it again.
  2. Reuse it immediately because max-age is still the dominant directive.
  3. Serve it only to requests that include an Authorization header.
  4. Treat it as stale and revalidate with the origin before serving it. Correct answer.

Explanation

The response becomes stale once max-age elapses, and must-revalidate forbids serving stale content without successful validation. The cache must therefore contact the origin, for example with a conditional request.

Question 22Web Application Fundamentals and HTTP

A client sends a POST request with the header Expect: 100-continue and then waits. What is the purpose of this exchange?

  1. To force the server to close the connection after the response.
  2. To require the server to redirect the request to HTTPS.
  3. To request that the response be compressed with gzip.
  4. To ask the server whether the request headers are acceptable before sending a large body. Correct answer.

Explanation

Expect: 100-continue lets a client pause before transmitting a potentially large body while the server replies with 100 Continue or a final status. This avoids wasting bandwidth when the request would be rejected.

Question 23Web Application Fundamentals and HTTP

An application creates a session identifier and stores it in a cookie. Which practice best mitigates session fixation attacks?

  1. Issuing a new session identifier after successful authentication Correct answer.
  2. Storing the identifier in the URL query string instead of a cookie
  3. Setting the cookie without the HttpOnly attribute
  4. Reusing the same identifier for the lifetime of the account to simplify tracking

Explanation

Session fixation succeeds when an attacker can predetermine a session identifier the victim later authenticates with. Rotating the identifier at login invalidates any pre-set value and is a standard defense.

Question 24Web Application Fundamentals and HTTP

A server returns 302 Found for a POST request. According to widely implemented behavior, how do most user agents handle the method on the redirected request?

  1. They convert the request to a PUT with the original body.
  2. They repeat the POST to the new Location with the original body.
  3. They change the method to GET and drop the body. Correct answer.
  4. They abort the redirect because POST cannot be redirected.

Explanation

Although the original 302 specification was ambiguous, browsers and many clients convert the redirected request to GET and discard the body. The 307 and 308 codes were defined to preserve the method and body explicitly.

Question 25Information Gathering and Reconnaissance

During passive reconnaissance for a web application assessment, which activity keeps you from touching the target's own infrastructure?

  1. Sending crafted requests to the login endpoint
  2. Probing TCP ports on the target's public IP range
  3. Running a directory brute-force against the web root
  4. Querying public certificate transparency logs for subdomains Correct answer.

Explanation

Passive reconnaissance relies on third-party or publicly available data sources, so the target never sees your traffic. Certificate transparency logs are published by CAs and reveal hostnames without any packet reaching the organization. The other options all generate direct traffic to target-owned systems.

Question 26Information Gathering and Reconnaissance

An analyst wants the registrant organization, creation date, and registrar for a domain. Which record source is authoritative for this registration data?

  1. A WHOIS or RDAP lookup against the registry/registrar Correct answer.
  2. The HTTP Server response header
  3. The DNS A record returned by the domain's nameserver
  4. A reverse DNS lookup on the resolved IP

Explanation

Registration details such as registrar, creation date, and registrant are held by registrars and registries and exposed through WHOIS or its structured successor RDAP. DNS records only map names to resources. HTTP headers and reverse DNS describe services, not ownership registration.

Question 27Information Gathering and Reconnaissance

Which DNS record type most directly reveals the mail infrastructure an organization uses for a domain, including third-party providers?

  1. TXT
  2. CNAME
  3. MX Correct answer.
  4. NS

Explanation

MX records list the mail exchangers responsible for accepting email for a domain, so they expose whether mail is hosted by a provider such as a cloud email service. CNAMEs alias names, TXT holds arbitrary text, and NS identifies authoritative nameservers.

Question 28Information Gathering and Reconnaissance

A tester resolves a hostname and finds it points to a content delivery network edge IP. What is the most reliable way to identify the origin server behind the CDN?

  1. Sending an HTTP OPTIONS request to the CDN edge
  2. Reviewing historical DNS data and certificate records for pre-CDN or direct-connect hostnames Correct answer.
  3. Checking the MX records of the parent domain
  4. Reading the CDN edge IP from the A record and scanning it

Explanation

CDN edges hide the origin, but historical DNS datasets, certificate transparency entries, and forgotten subdomains often still resolve directly to the origin. Scanning the edge IP only tests CDN infrastructure. HTTP methods and MX records do not reveal origin addresses.

Question 29Information Gathering and Reconnaissance

Which technique maps the path a packet takes toward a target and can reveal intermediate routers?

  1. Traceroute Correct answer.
  2. Banner grabbing
  3. Reverse DNS sweep
  4. Zone transfer

Explanation

Traceroute sends packets with incrementing TTL values and records the ICMP responses from each hop, exposing intermediate routers along the path. Zone transfers copy DNS records, banner grabbing reads service greetings, and reverse DNS resolves IPs to names.

Question 30Information Gathering and Reconnaissance

A security team wants to enumerate hosts on a subnet without completing TCP handshakes. Which scan approach best matches that goal?

  1. TCP SYN scan that sends a SYN and evaluates the reply without completing the handshake Correct answer.
  2. ICMP timestamp request sweep
  3. UDP scan that sends empty datagrams
  4. TCP connect scan using the operating system's connect call

Explanation

A SYN scan sends a SYN and interprets SYN-ACK, RST, or no reply, then tears down before the handshake completes, so full connections are never established. A connect scan completes the handshake through the OS. UDP and ICMP methods do not use the TCP handshake at all.

Question 31Information Gathering and Reconnaissance

Which search operator would you use to restrict results to a specific site while looking for exposed documents?

  1. cache:example.com pdf
  2. link:example.com ext:pdf
  3. site:example.com filetype:pdf Correct answer.
  4. inurl:example.com intitle:pdf

Explanation

Combining site: with filetype: limits indexed results to a single domain and a chosen document extension, a standard way to find exposed files. The other combinations either use unsupported operators or do not constrain both domain and file type correctly.

Question 32Information Gathering and Reconnaissance

During reconnaissance you find a DNS server that answers an AXFR request from your host. What does this indicate?

  1. The server is configured to allow unrestricted zone transfers to any requester Correct answer.
  2. The server supports DNSSEC validation by default
  3. The server is a caching resolver with no authoritative data
  4. The server is running a recursive query service for the internet

Explanation

AXFR is a zone transfer that should be restricted to authorized secondary servers. If an arbitrary host receives a full transfer, the server permits unrestricted zone transfers, exposing every record in the zone. Caching, DNSSEC validation, and recursion are unrelated to AXFR access control.

Question 33Information Gathering and Reconnaissance

An OSINT analyst wants to discover employee names and roles before a social engineering test. Which source is most appropriate for that goal?

  1. TCP port scan results from the perimeter
  2. The target's authoritative nameserver records
  3. TLS certificate serial numbers
  4. Company press releases and professional networking profiles Correct answer.

Explanation

Press releases, staff pages, and professional networking profiles publish names, titles, and organizational structure, which is exactly the personnel intelligence needed. DNS records, port scans, and certificate serials reveal technical infrastructure rather than people.

Question 34Information Gathering and Reconnaissance

A tester notices the target's web server returns a header listing a specific framework version. What is the primary reconnaissance value of that banner?

  1. It discloses the internal routing table
  2. It confirms the server's TLS cipher suite
  3. It identifies software and version that can be matched to known vulnerabilities Correct answer.
  4. It reveals the organization's registrar account

Explanation

Service banners and version headers fingerprint the software in use, allowing the tester to correlate that version with known vulnerabilities and default configurations. They do not expose cipher suites, registrar details, or internal routing.

Question 35Information Gathering and Reconnaissance

Which artifact from a TLS certificate is most useful for discovering additional hostnames belonging to an organization?

  1. The Subject Alternative Name entries Correct answer.
  2. The signature algorithm OID
  3. The certificate's public key size
  4. The validity not-before date

Explanation

Subject Alternative Name entries list every hostname the certificate covers, so a single certificate can reveal many subdomains. Key size, signature algorithm, and validity dates describe cryptographic properties but do not enumerate names.

Question 36Information Gathering and Reconnaissance

A tester runs a reverse DNS sweep across a /24 and finds only a few PTR records. What is the correct interpretation?

  1. All hosts on the subnet are offline
  2. PTR records are missing for many hosts, so the sweep undercounts live systems Correct answer.
  3. The subnet is protected by a firewall that blocks ICMP
  4. The domain has no authoritative nameserver

Explanation

Reverse DNS depends on PTR records being configured, and many organizations leave them unset for internal or non-public hosts. A sparse result therefore undercounts live systems and should be supplemented with active discovery. It does not prove hosts are offline or that a firewall exists.

Question 37Information Gathering and Reconnaissance

Which of the following best describes the purpose of a DNS brute-force with a wordlist of common subdomain names?

  1. To poison the resolver cache with forged answers
  2. To discover hostnames that are not linked publicly but still resolve Correct answer.
  3. To transfer the zone from the authoritative server
  4. To enumerate MX priorities for mail routing

Explanation

Subdomain brute-forcing queries a large list of candidate labels against the target's DNS and records which ones resolve, revealing unlinked but live hostnames. It does not perform zone transfers, cache poisoning, or MX enumeration.

Question 38Information Gathering and Reconnaissance

An analyst collects a list of IP addresses from a target's autonomous system number. Which tool or data source is designed to map an ASN to its announced prefixes?

  1. An HTTP robots.txt file
  2. The server's TLS certificate chain
  3. The domain's SOA record
  4. BGP routing data from public looking glasses or routeviews collectors Correct answer.

Explanation

ASNs announce IP prefixes through BGP, and public route collectors and looking glasses publish those announcements, letting an analyst map an ASN to its address space. SOA records, robots.txt, and certificate chains do not describe routed prefixes.

Question 39Information Gathering and Reconnaissance

Which activity is considered active reconnaissance against an external target?

  1. Reviewing the target's SEC filings
  2. Reading the target's job postings for technology mentions
  3. Performing a TCP connect scan of the target's public IPs Correct answer.
  4. Querying a public archive of past website snapshots

Explanation

Active reconnaissance sends traffic directly to target-owned systems, and a TCP connect scan does exactly that, leaving records in logs and firewalls. Reading job postings, archives, and regulatory filings relies on third-party or published sources and stays passive.

Question 40Information Gathering and Reconnaissance

A tester wants to fingerprint the web server software and version without triggering an application error. Which approach is most appropriate?

  1. Reviewing standard response headers and default error pages Correct answer.
  2. Sending malformed requests until a stack trace appears
  3. Running a full TCP SYN scan of all 65535 ports
  4. Querying the domain's NS records

Explanation

Response headers such as Server and X-Powered-By, plus default error pages, often reveal software and version with ordinary requests. Inducing stack traces is more intrusive and unreliable, port scanning reveals open services but not application versions, and NS records describe DNS authority.

Question 41Information Gathering and Reconnaissance

You discover a staging subdomain that resolves to an internal RFC 1918 address. What does this most likely indicate?

  1. The DNS record leaks internal addressing that may be reachable through a VPN or split-horizon setup Correct answer.
  2. The organization has no firewall at the perimeter
  3. The record is a wildcard entry for all subdomains
  4. The subdomain is a decoy with no real infrastructure

Explanation

A public DNS record pointing to a private address suggests the host is meant for internal access and the name leaked into public DNS, which can aid an attacker who gains internal network access. It does not prove the absence of a firewall or that the entry is a decoy or wildcard.

Question 42Information Gathering and Reconnaissance

Which source best supports discovering an organization's technology stack from the outside?

  1. The TTL of the A record
  2. The domain's WHOIS creation date
  3. Wappalyzer-style fingerprinting of HTTP responses and assets Correct answer.
  4. The MX record preference values

Explanation

Fingerprinting tools inspect headers, cookies, script paths, and asset names in HTTP responses to infer frameworks, servers, and libraries. WHOIS dates, MX preferences, and TTL values describe registration and DNS behavior, not application technology.

Question 43Information Gathering and Reconnaissance

A company publishes SPF, DKIM, and DMARC records. Which reconnaissance insight do these TXT records provide?

  1. They disclose the web application firewall vendor
  2. They reveal the primary database engine
  3. They identify authorized sending mail services and email security posture Correct answer.
  4. They list the organization's internal employee directory

Explanation

SPF and DMARC TXT records name the services authorized to send mail for the domain, and their presence or policy strength indicates the email security posture. They do not list employees, identify a WAF, or disclose database software.

Question 44Information Gathering and Reconnaissance

Which combination of techniques best validates that two hostnames discovered by separate OSINT sources belong to the same organization?

  1. Counting the number of characters in each hostname
  2. Comparing their resolved IPs, certificate SANs, and WHOIS registrant data Correct answer.
  3. Measuring response latency for each hostname
  4. Checking each hostname's HTTP status code only

Explanation

Shared infrastructure and registration evidence, such as overlapping IP ranges, certificates covering both names, and matching registrant records, provide corroboration that names belong to one organization. Status codes, latency, and name length are weak indicators that do not establish ownership.

Question 45Authentication and Session Management Testing

During a web application assessment, you observe that after a successful login the session identifier in the cookie remains identical to the value issued before authentication. Which weakness does this most directly indicate?

  1. Session fixation due to failure to rotate the session ID at privilege change Correct answer.
  2. Cross-site request forgery caused by absent anti-CSRF tokens
  3. Insufficient cookie entropy caused by a weak PRNG
  4. Missing HttpOnly flag on the session cookie

Explanation

A session identifier that survives the transition from anonymous to authenticated state allows an attacker who pre-set that value to ride the victim's authenticated session. The correct remediation is to invalidate the old identifier and issue a fresh one on every privilege boundary, including login and role elevation.

Question 46Authentication and Session Management Testing

Which cookie attribute instructs the browser to withhold the session cookie from cross-site requests while still allowing it to be sent on same-site navigations?

  1. Path
  2. Domain
  3. SameSite Correct answer.
  4. Secure

Explanation

The SameSite attribute controls whether cookies accompany cross-site requests, with Lax, Strict, and None modes governing the exact behavior. Secure only restricts transmission to HTTPS, while Domain and Path scope where the cookie is sent rather than the request context.

Question 47Authentication and Session Management Testing

An application stores the raw session identifier in its server-side session table. A database read-only compromise occurs. Why is storing only a hash of the identifier preferable?

  1. It removes the need for TLS on the session cookie
  2. It reduces the storage footprint of the session table
  3. It prevents an attacker with database access from replaying live sessions Correct answer.
  4. It makes the identifier unpredictable to the client

Explanation

If the server keeps only a cryptographic hash of the identifier, a database leak does not directly yield usable session tokens, because the attacker would have to invert the hash to obtain the original value. This mirrors password storage rationale and limits the blast radius of a data exposure.

Question 48Authentication and Session Management Testing

A tester captures a login request and notices the credentials are submitted in a URL query string over HTTPS. What is the primary session-related risk?

  1. The session cookie will be rejected by the browser
  2. The credentials may be recorded in browser history, proxy logs, and Referer headers Correct answer.
  3. The TLS handshake will fail because of the query string
  4. The password will be hashed twice by the server

Explanation

Data placed in the query string leaks into numerous logging and caching surfaces, including server access logs, proxy logs, browser history, and Referer headers sent to third parties. Credentials should travel in the request body over TLS so these channels do not capture them.

Question 49Authentication and Session Management Testing

Which testing technique best determines whether an application enforces a maximum session lifetime regardless of user activity?

  1. Comparing session identifiers issued to two different accounts
  2. Replaying a captured cookie after the advertised idle timeout has elapsed
  3. Inspecting the Set-Cookie header for the Secure attribute
  4. Keeping a session active with periodic requests and observing behavior past the absolute timeout Correct answer.

Explanation

An absolute timeout is measured from authentication, not from last activity, so the session must be kept alive artificially and then observed beyond the absolute limit. Idle timeout testing, by contrast, requires leaving the session untouched.

Question 50Authentication and Session Management Testing

An application authenticates users and then issues a JWT signed with the HMAC algorithm. A tester changes the header algorithm to "none" and the server accepts the token. What is the root cause?

  1. The signature is computed over the wrong payload encoding
  2. The token lacks an expiration claim
  3. The HMAC secret is too short to resist brute force
  4. The server trusts the algorithm declared in the token header instead of pinning an expected algorithm Correct answer.

Explanation

Algorithm confusion arises when the verifier reads the alg header and honors whatever it finds, including none or an asymmetric algorithm verified with a public key as secret. The verifier must pin the accepted algorithm and reject tokens that declare anything else.