A company’s security policy states that all Web browsers must automatically delete their HTTP browser...

HTTP cookies may store authentication tokens, allowing users to remain logged in. If a browser retains cookies after closing, an attacker with access to the device could hijack active sessions.

Automatically deleting cookies upon termination reduces the window of opportunity for session hijacking.

Reference – CEH v13 Official Study Guide:

Module 11: Hacking Web Applications

Topic: Session Management

Quote:

“Session hijacking exploits persistent cookies or session IDs stored in browsers. Enforcing cookie deletion helps prevent this attack.”

Incorrect Options:

A. SQL databases are unrelated to browser cookies.

C. Browser cookies don’t store OS-level passwords.

D. This may be a secondary concern, but not the primary mitigation.

===========