CEH - Certified Ethical Hacker Practice Questions: Session Hijacking Domain

Published: June 9, 2025 | 5 min read

Test your CEH - Certified Ethical Hacker knowledge with 5 practice questions from the Session Hijacking domain. Includes detailed explanations and answers.

CEH - Certified Ethical Hacker Practice Questions

Master the Session Hijacking Domain

Test your knowledge in the Session Hijacking domain with these 5 practice questions. Each question is designed to help you prepare for the CEH - Certified Ethical Hacker certification exam with detailed explanations to reinforce your learning.

Question 1

During a security assessment, you need to prove the vulnerability of session IDs to hijacking. Which method is most effective for capturing session IDs on an unsecured network?

A) Conducting a ping sweep to identify active sessions.

B) Using a packet sniffer to capture unencrypted session IDs.

C) Performing a SQL injection to extract session information.

D) Sending phishing emails to users on the network.

Show Answer & Explanation

Correct Answer: B

Explanation: Packet sniffing allows the capture of unencrypted session IDs as they traverse the network, demonstrating their vulnerability to interception.

Question 2

A user reports suspicious account activity and suspects session hijacking. How can an ethical hacker verify if session hijacking occurred?

A) Check for unusual IP addresses in server logs.

B) Scan for open ports on the user's machine.

C) Look for signs of malware infection.

D) Perform a vulnerability scan on the user's browser.

Show Answer & Explanation

Correct Answer: A

Explanation: Unusual IP addresses in server logs can indicate that a session was accessed from an unauthorized location, suggesting session hijacking.

Question 3

What is the purpose of the 'HttpOnly' attribute in cookies concerning session security?

A) To prevent cookies from being sent over HTTP

B) To prevent JavaScript access to cookies

C) To ensure cookies are only sent to the same domain

D) To encrypt cookies during transmission

Show Answer & Explanation

Correct Answer: B

Explanation: CORRECT: The 'HttpOnly' attribute prevents JavaScript from accessing cookies, reducing the risk of session hijacking via XSS. OPTION A: 'HttpOnly' does not prevent HTTP transmission; 'Secure' does. OPTION B: Same-origin policy controls domain access, not 'HttpOnly'. OPTION C: Cookie encryption requires additional measures, not 'HttpOnly'. OPTION D: Cookie encryption requires additional measures, not 'HttpOnly'.

Question 4

A company's web application is vulnerable to session fixation attacks. What is the most appropriate defense strategy to mitigate this risk effectively?

A) Implement HTTPS to encrypt all sessions.

B) Regenerate session IDs upon successful login.

C) Use strong password policies.

D) Enable Multi-Factor Authentication (MFA).

Show Answer & Explanation

Correct Answer: B

Explanation: Option B is correct because regenerating session IDs upon login prevents attackers from using fixed session IDs. Option A secures data in transit but doesn't prevent fixation. Option C and D are good practices but not directly related to session fixation mitigation.

Question 5

An attacker is attempting to perform session fixation on a target application. What is the primary goal of session fixation?

A) To cause a denial of service

B) To steal encrypted credentials

C) To force a user to use a known session ID

D) To inject malicious code into the server

Show Answer & Explanation

Correct Answer: C

Explanation: CORRECT: Session fixation aims to force a user to use a session ID known to the attacker, enabling hijacking. OPTION A: Denial of service is about service disruption, not session control. OPTION B: Session fixation does not aim to steal encrypted credentials directly. OPTION C: Injecting code is not the goal of session fixation; controlling session IDs is. OPTION D: Injecting code is not the goal of session fixation; controlling session IDs is.

Ready to Accelerate Your CEH - Certified Ethical Hacker Preparation?

Join thousands of professionals who are advancing their careers through expert certification preparation with FlashGenius.

✅ Unlimited practice questions across all CEH - Certified Ethical Hacker domains
✅ Full-length exam simulations with real-time scoring
✅ AI-powered performance tracking and weak area identification
✅ Personalized study plans with adaptive learning
✅ Mobile-friendly platform for studying anywhere, anytime
✅ Expert explanations and study resources

Start Free Practice Now

Already have an account? Sign in here

About CEH - Certified Ethical Hacker Certification

The CEH - Certified Ethical Hacker certification validates your expertise in session hijacking and other critical domains. Our comprehensive practice questions are carefully crafted to mirror the actual exam experience and help you identify knowledge gaps before test day.

📘 Looking for the full study guide?
Check out our comprehensive guide: CEH Mock Exam Mastery: Practice Questions & Insights