Skip to content

CS KAIROS · LEARNING LIBRARY

M11 · Session Hijacking · Q&A

Check understanding with original scenarios and a reason for every option. These answers do not establish exam or practical readiness.

Scenario questions

ceh-m11-session-q1 · Original practice

Does seeing the logout screen prove the old token is invalid?

JavaScript is off: read the answer and explanation

B

UI state does not replace server-side verification.
Validity depends on the server’s verification process.
Local deletion does not automatically revoke other copies.
Systems can implement expiration and revocation.

ceh-m11-session-q2 · Original practice

What does HttpOnly primarily restrict?

JavaScript is off: read the answer and explanation

A

This is the central purpose of HttpOnly.
It is not a complete XSS defense.
Cross-site transmission also involves SameSite and CSRF controls.
The server still reads the cookie to handle sessions.

Continue to safe practice →