hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: During a security assessment, a penetration…
During a security assessment, a penetration tester discovers that a web application's session tokens are predictable. The application uses a custom session management system. Which of the following is the MOST effective remediation to ensure secure session tokens?
⚠ Common exam trap
CompTIA often tests the misconception that regenerating tokens frequently or using HMAC with a secret key is sufficient, when in fact the core issue is insufficient entropy in the token generation process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate session tokens using a cryptographically secure random number generator (CSPRNG) with at least 128 bits of entropy.
Predictable session tokens arise from insufficient randomness. Using a cryptographically secure random number generator (CSPRNG) with at least 128 bits of entropy ensures that tokens are statistically unpredictable and resistant to brute-force or guessing attacks, which is the foundational requirement for secure session management per NIST SP 800-63B and OWASP guidelines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Generate session tokens using a cryptographically secure random number generator (CSPRNG) with at least 128 bits of entropy.
Why this is correct
CSPRNGs produce unpredictable values resistant to analysis, ensuring that session tokens cannot be guessed.
- ✗
Regenerate the session token on each page request.
Why it's wrong here
Frequent regeneration increases overhead and does not solve the underlying predictability; if the generation method is weak, tokens remain predictable.
- ✗
Implement a short session timeout of 5 minutes.
Why it's wrong here
Timeouts limit the window of attack but do not fix the predictability; an attacker can still predict and hijack a session.
- ✗
Generate tokens using HMAC-SHA256 of a timestamp and a secret key.
Why it's wrong here
This method can be predictable if the attacker can derive the pattern; it's better than simple sequential but still not as strong as a CSPRNG.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.