CISSP Software Development Security Practice Question
An application authenticates users using session tokens. A security analyst finds that the application does not invalidate session tokens after logout, allowing session fixation attacks. Which secure coding practice should be implemented to mitigate this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Regenerating session ID after successful login
Proper session management includes invalidating session tokens on logout and generating new tokens after authentication to prevent fixation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using short session timeouts
Why it's wrong here
Short timeouts reduce the window of attack but do not prevent fixation.
- ✗
Setting the secure flag on cookies
Why it's wrong here
Secure flag ensures cookies are sent over HTTPS only, but does not prevent fixation.
- ✓
Regenerating session ID after successful login
Why this is correct
Regenerating session ID prevents fixation by ensuring the attacker's session ID is not used.
- ✗
Implementing HTTPS for all communications
Why it's wrong here
HTTPS protects data in transit but does not prevent session fixation.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.