Session state variables are specific to a single user session and cannot be accessed by other users or sessions. They persist only for the duration of that specific session and are isolated from other sessions. Option A is incorrect because session state is not shared across all users, and Option C is incorrect - sessions don't work at a 'tunnel' level.