What type of security policy does a company implement regarding HTTP cookies?

• A. To encrypt cookies
• B. To automatically delete cookies upon browser termination
• C. To block cookies entirely
• D. To store cookies in the cloud.

Answer: (D)

Centralized management of cookies is the concept being tested. Storing cookies in the cloud means keeping cookie-related state in a centralized, cloud-based system rather than relying solely on stored data on each user’s device. This enables consistent enforcement of security controls across all endpoints, easier session management, and better auditing and compliance.

Why this fits the best: with centralized storage, an organization can control how cookies are issued, what attributes they use (such as Secure and HttpOnly), how long sessions last, and when to revoke access. It also makes it possible to invalidate sessions across multiple devices if a risk is detected, without depending on the end user’s browser. In practice, the client may only hold a session identifier, while the server-side stores the actual session data, reducing exposure from endpoint compromise.

Other options describe techniques or behaviors rather than a centralized policy. Encrypting cookies focuses on protecting data within the cookie itself, not on where cookies are stored or how they’re managed overall. Deleting cookies on browser termination is a client-side behavior that doesn’t provide centralized control. Blocking cookies entirely would break functionality and isn’t a practical security policy for most organizations.