mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A company deploys a new web application and wants…
A company deploys a new web application and wants to ensure that session tokens are not vulnerable to session hijacking. Which of the following controls is most effective?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the Secure and HttpOnly flags on session cookies.
Setting the Secure and HttpOnly flags ensures cookies are only sent over HTTPS and not accessible via JavaScript, preventing interception and XSS-based theft. Option A (bind to IP) can cause issues with mobility; Option B (short timeout) helps reduce exposure but does not prevent hijacking; Option C (encrypt token) is redundant if HTTPS is used; Option D (regenerate after each request) is impractical and not necessary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Bind the session token to the user's IP address.
Why it's wrong here
IP binding can cause accessibility issues and may not prevent hijacking from same network.
- ✗
Set a short session timeout (e.g., 5 minutes).
Why it's wrong here
Short timeout reduces window of opportunity but does not prevent theft.
- ✗
Encrypt the session token using AES.
Why it's wrong here
Encryption of the token is unnecessary; HTTPS protects in transit.
- ✗
Regenerate the session ID after every request.
Why it's wrong here
Regenerating after each request is resource-intensive and may break functionality.
- ✓
Set the Secure and HttpOnly flags on session cookies.
Why this is correct
Secure flag forces HTTPS; HttpOnly prevents script access, mitigating XSS-based theft.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.