Answer C is correct. Answer A is incorrect because this is a technical necessity, not
a best practice. Answer B is incorrect because accessing the session data store is
completely independent of whether there has been any output. Answer D is incorrect
because you can set other HTTP headers after a call to session_start().