Which practice best describes session management protection?

• A. Shadow AI
• B. Session Management - protection
• C. SIEM/SOAR
• D. Social Engineering attacks

Answer: (B)

Securing how a user’s session is created, maintained, and terminated is the core idea here. Session management protection focuses on making sessions hard to steal, reuse, or hijack, and on ensuring they expire cleanly when a user logs out or after a period of inactivity.

Key practices include generating unpredictable session IDs, rotating or renewing the ID after authentication, and invalidating the session on logout. Use TLS for all session traffic, and protect cookies with HttpOnly (not accessible to JavaScript), Secure (sent only over HTTPS), and SameSite attributes to reduce cross-site request forgery risks. Consider whether to store session data on the server or use short-lived tokens with proper revocation and rotation, and enforce re-authentication for sensitive actions. Implement reasonable timeouts and monitor for unusual patterns like multiple concurrent sessions or sudden IP changes.

Other options don’t directly address protecting the lifecycle of a user’s session: one relates to AI-related activities, another to security monitoring and automation, and the last to human-level attack techniques. The best fit is the practice that explicitly protects session management.