Ethical Hacking Essentials Practice Test

Which of the following is a recommended countermeasure against session hijacking?

1. Disable cookies

2. Use HPKP to allow users to authenticate web servers

3. Limit network access to administrators

4. Encrypt all network traffic

The correct answer is: Use HPKP to allow users to authenticate web servers

Using HTTP Public Key Pinning (HPKP) is a recommended countermeasure against session hijacking because it helps ensure that users are connecting to the legitimate web server. HPKP enables a website to specify which public keys are authorized to be used in the service by the client, helping to prevent man-in-the-middle attacks that could enable session hijacking. By enforcing the use of specific public keys, clients can avoid interacting with malicious servers that may attempt to impersonate a legitimate service. On the other hand, disabling cookies is not a practical solution because many web applications rely on cookies for maintaining user sessions securely. Limiting network access to administrators focuses more on access control rather than specifically addressing the vulnerabilities that allow session hijacking to occur. Encrypting all network traffic is important for protecting data in transit but does not directly prevent session hijacking if proper session management practices are not also followed.