Question 91 of 870
Which Three Techniques are Used in Session Hijacking?
Which THREE of the following are techniques used in session hijacking? (Select three.)
Quick Answer
The answer is cookie theft, along with TCP sequence prediction and ARP poisoning. Cookie theft allows an attacker to steal a valid session token, often through cross-site scripting, and use it to impersonate a legitimate user. TCP sequence prediction exploits the ability to guess or calculate the sequence numbers in a TCP connection, enabling the injection of malicious packets to hijack an active session. ARP poisoning corrupts the local Address Resolution Protocol cache, placing the attacker in a man-in-the-middle position to intercept and take over the session traffic. On the Certified Ethical Hacker CEH exam, this question tests your understanding of network-level and application-level hijacking vectors; a common trap is confusing session hijacking with session fixation or brute-forcing. Remember the mnemonic “CAT” for Cookie theft, ARP poisoning, and TCP sequence prediction to lock in the three core techniques.
⚠ Common exam trap
Watch out — candidates often confuse network reconnaissance or DoS techniques (like DNS amplification or MAC flooding) with active session hijacking methods, which require direct manipulation of session tokens or TCP state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP poisoning
ARP poisoning is correct because it allows an attacker on the same local network to associate their MAC address with the IP address of a legitimate host (e.g., the default gateway). This redirects traffic through the attacker's machine, enabling them to intercept and hijack active sessions by capturing or modifying packets in transit, a classic man-in-the-middle (MITM) technique used in session hijacking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ARP poisoning
Why this is correct
Correct. ARP poisoning enables MITM, which can be used to hijack sessions.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a DDoS technique, not session hijacking.
- ✓
TCP sequence prediction
Why this is correct
Correct. Predicting TCP sequence numbers allows hijacking an active TCP session.
- ✓
Cookie theft
Why this is correct
Correct. Stealing session cookies (e.g., via XSS) allows hijacking a web session.
- ✗
MAC flooding
Why it's wrong here
MAC flooding overwhelms switch CAM tables, but is not directly session hijacking.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are valid techniques for session hijacking? (Select 2)
medium- A.DNS spoofing
- B.MAC flooding
- ✓ C.TCP sequence prediction
- ✓ D.Cookie theft
- E.ARP poisoning
Why C: TCP sequence prediction is a valid session hijacking technique because it allows an attacker to spoof a legitimate client's TCP connection by predicting the sequence numbers used for packet ordering. By correctly guessing the next sequence number, the attacker can inject malicious packets into the established session, effectively hijacking it without needing the client's credentials.
Variation 2. Which THREE of the following are techniques used in session hijacking?
hard- A.DNS cache poisoning
- ✓ B.Man-in-the-middle (MITM) interception
- C.MAC flooding
- ✓ D.Cookie theft and replay
- ✓ E.TCP sequence number prediction
Why B: Session hijacking involves an attacker taking control of a legitimate user's active session. Man-in-the-middle (MITM) interception allows an attacker to position themselves between the client and server, intercepting and manipulating traffic, including session tokens, to impersonate the user. Cookie theft and replay is another direct method where an attacker steals a valid session cookie and uses it to authenticate as the legitimate user. TCP sequence number prediction, while less common now, was a technique where an attacker could guess the next sequence number in a TCP session to inject packets and take control of the communication.
Last reviewed: Jul 4, 2026
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.