Discuss EC-Council 212-89 Exam Topic 9 Question 89

[Introduction to Incident Handling and Response]

If the browser does not expire the session when the user fails to logout properly, which of the following OWASP Top 10 web vulnerabilities is caused?

AA7: Cross-site scripting

BA3: Sensitive- data exposure

CA2: Broken authentication

DA5: Broken access control

Suggested Answer: C

When a browser does not expire a session after the user fails to logout properly, it is indicative of a vulnerability related to broken authentication. Broken authentication is a security issue where attackers can exploit flaws in the authentication mechanism to impersonate other users or take over their sessions. Failure to properly manage session lifetimes, such as not expiring sessions on logout, can allow an attacker to reuse old sessions or session IDs, potentially gaining unauthorized access to user accounts. This vulnerability is classified under A2: Broken Authentication in the OWASP Top 10, which lists the most critical web application security risks. The OWASP Top 10 serves as a guideline for developers and web application providers to understand and mitigate common security risks.

Get Premium 212-89 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Gaynell 6 months ago

True, but if the session isn't expired, it's mainly authentication issues.

Dottie 6 months ago

But what about B) A3: Sensitive-data exposure?

Julianna 6 months ago

I agree, session management is key.

Catherin 6 months ago

I think it's C) A2: Broken authentication.

Dyan 6 months ago

I didn't know session expiration could lead to broken authentication!

Launa 7 months ago

Wait, are we sure it's not D) A5? Seems like a close call.

Hyun 7 months ago

Yeah, C makes the most sense here.

Sharen 7 months ago

I thought it was B) A3: Sensitive-data exposure.

Yan 7 months ago

Definitely C) A2: Broken authentication.

Anna 7 months ago

Haha, this is a classic "which vulnerability is it" question. I'm going with C, gotta keep those sessions secure!

Willard 7 months ago

Hmm, I'd say B) A3: Sensitive data exposure. That open session could reveal all kinds of sensitive info.

Nydia 8 months ago

I'm going with D) A5: Broken access control. Sounds like a session management issue to me.

Keena 8 months ago

Definitely C. Leaving the session open is a security nightmare waiting to happen.

Jestine 8 months ago

C) A2: Broken authentication is the correct answer. If the browser doesn't expire the session, it can lead to unauthorized access.

Hermila 9 months ago

I’m confused; I thought session management could also tie into access control issues, but I guess that’s more about A5?

Stacey 9 months ago

I practiced a question similar to this, and I feel like it was about authentication problems, so I'm leaning towards A2 as well.

Sherrell 9 months ago

I'm not entirely sure, but I remember something about session expiration being linked to sensitive data exposure. Could it be A3?

Ben 9 months ago

I think this might relate to A2: Broken authentication since it deals with session management issues.

Maile 9 months ago

Ah, I see now. If the session isn't properly expired, that means an attacker could potentially hijack the session and gain unauthorized access. That sounds like a broken authentication issue to me. I'll go with C.

Dewitt 10 months ago

I think the key here is understanding how session management is related to the OWASP Top 10. If the session isn't properly expired, that could lead to broken access control. I'm going with D.

Eladia 10 months ago

I'm a bit confused here. Is this about cross-site scripting or broken authentication? I'm not sure which one fits best.

Maybelle 10 months ago

Okay, let's see. If the browser doesn't expire the session, that could lead to sensitive data exposure, right? I'm leaning towards B.

Yuette 10 months ago

Hmm, this seems like a tricky one. I'll need to think carefully about the OWASP Top 10 vulnerabilities and how they relate to session management.

Coletta 4 months ago

↳ replying to Yuette

I agree, if sessions aren't expired, it could lead to unauthorized access.

Tennie 4 months ago

↳ replying to Yuette

Yeah, broken authentication makes sense here.

Tarra 6 months ago

↳ replying to Yuette

I think it's definitely related to session management.

EC-Council 212-89 Exam - Topic 9 Question 89 Discussion