CEH Session Hijacking Practice Question
Which TWO of the following are examples of session hijacking attacks? (Select 2)
⚠ Common exam trap
It's easy for candidates to confuse network-level attacks (like ARP poisoning or DNS spoofing) with session hijacking, but the CEH exam specifically defines session hijacking as the takeover of an authenticated TCP or application-layer session, which requires either stealing a session token (cookie theft) or predicting TCP sequence numbers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cookie theft
Both cookie theft and TCP sequence prediction are session hijacking attacks. Cookie theft involves stealing a session identifier (e.g., via XSS or sniffing) to impersonate the victim's authenticated web session. TCP sequence prediction targets the transport layer: an attacker predicts the sequence numbers used in a TCP connection to inject forged packets and hijack the session, taking over an established TCP connection. These attacks directly take over an authenticated session, distinguishing them from other network attacks like ARP poisoning or DNS spoofing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing redirects traffic, but not specifically session hijacking.
- ✓
Cookie theft
Why this is correct
Stealing session cookies allows an attacker to impersonate a user.
- ✗
MAC flooding
Why it's wrong here
MAC flooding is a switch attack, not session hijacking.
- ✓
TCP sequence prediction
Why this is correct
TCP sequence prediction allows an attacker to spoof a session.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning is a MITM attack that can lead to session hijacking but is not a session hijacking attack per se.
Visual reference
Go deeper
Related to this question
Learn chapter
Sniffing
Key term
Cross Site Scripting XSS
Cross Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users, enabling theft of data or session hijacking.
Key term
Session Hijacking
Session hijacking is an attack where a cybercriminal steals or takes over a user's active session with a web application, allowing the attacker to pretend to be that user without needing their password.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.