ITPEC IP April 2024 Question 32
ITPEC IP April 2024 — Question 32 of 100
A stolen session cookie can let an attacker hijack the victim's web-service account. After login, a site often uses a cookie containing a session identifier to recognize subsequent requests. If cross-site scripting extracts that value and the attacker reuses it before it expires, the server may treat the attacker as the authenticated victim without requiring the password again.
Answer (c)
Why not others:
- (a) virus infection requires malicious executable behavior and is not the direct consequence of session-cookie theft
- (b) sending arbitrary PC files outside requires separate malware or file-access exploitation
- (d) wireless LAN intrusion concerns network access controls and radio security rather than browser cookies
Key rule: Authentication cookies are bearer credentials: anyone who obtains a valid session token may be able to impersonate that session, so XSS defenses and secure cookie settings are essential.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.