Which statement describes a session identifier used during client-server communication?

Which statement describes a session identifier used during client-server communication?

• A. A cryptographic certificate
• B. A unique token that a server assigns for the duration of a client's communications with the server
• C. The client's IP address
• D. A login username

Answer: (B)

A session identifier is a unique token that the server issues to represent a specific client’s session for the duration of their interaction. This token is sent with each request (commonly via a cookie) so the server can retrieve the correct session data and maintain state over a stateless protocol like HTTP. It’s designed to be random and hard to predict to reduce the risk of session hijacking, and it’s typically short-lived to limit exposure if it’s compromised. This isn’t a cryptographic certificate, which is used to authenticate and secure the channel; it isn’t the client’s IP address, which identifies the host rather than the session; and it isn’t a login username, which identifies the user rather than the ongoing session.

A session identifier is a unique token that the server issues to represent a specific client’s session for the duration of their interaction. This token is sent with each request (commonly via a cookie) so the server can retrieve the correct session data and maintain state over a stateless protocol like HTTP. It’s designed to be random and hard to predict to reduce the risk of session hijacking, and it’s typically short-lived to limit exposure if it’s compromised. This isn’t a cryptographic certificate, which is used to authenticate and secure the channel; it isn’t the client’s IP address, which identifies the host rather than the session; and it isn’t a login username, which identifies the user rather than the ongoing session.