ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Persistent connections can be abused if they remain open indefinitely: attackers may hijack dormant sessions, and unused connections consume server resources needed for other clients. Implementing idle-session timeouts combined with periodic heartbeat or ping/pong messages lets the server quickly detect inactivity or dropped clients and close or renegotiate the channel, limiting the window for hijacking, avoiding resource exhaustion, and ensuring only legitimate, active clients retain long-lived connectivity. Strong authentication and data-at-rest encryption are important but do not directly mitigate the unique exposure created by always-on WebSocket channels, while forcing a stateless load balancer to terminate long-lived sessions would break required functionality without addressing security concerns effectively.