Cross-Site Request Forgery (CSRF) - GET and POST Methods WAHS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst is investigating a suspected CSRF attack. The application logs show a POST request to /change-password with valid session cookies and a valid anti-CSRF token. The request originated from an external IP. Which conclusion is most likely?

   • AThe request is a normal user action and not an attack
   • BThe CSRF token is not effective because it was sent over HTTP
   • CThe CSRF token was generated by the server but not validated
   • DThe anti-CSRF token was leaked or the attacker had access to the victim's browser
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst is investigating a suspected CSRF attack. The application logs show a GET request to /user/email?new=attacker@example.com from the victim's IP address, and the email was changed. The victim claims they did not click any link. Which of the following is the most likely explanation?

   • AThe victim visited a malicious page that contained an <img> tag pointing to the URL, and the browser automatically sent the request.
   • BThe attacker used a cross-site scripting (XSS) vulnerability to execute JavaScript in the victim's browser.
   • CThe attacker guessed the victim's session cookie and sent the request from the attacker's machine.
   • DThe victim's browser was infected with malware that sent the request.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which types of web application functions are most likely to be targeted by CSRF attacks?

   • AFunctions that perform state-changing actions, such as updating a profile or transferring funds.
   • BFunctions that are only accessible to administrators.
   • CFunctions that only read data, such as viewing account balances or search results.
   • DFunctions that require multi-factor authentication (MFA) to execute.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is deploying a new web application and must choose a CSRF defense. The application will be used by customers who often click links from external emails and sites. The team wants to minimize broken functionality while providing strong CSRF protection. Which approach is the best choice?

   • AUse a CAPTCHA on all state-changing requests.
   • BUse SameSite=Strict cookies and require a custom header for all requests.
   • CUse a double-submit cookie pattern and rely on the browser's default SameSite behavior.
   • DUse SameSite=Lax cookies and a synchronizer token for all state-changing POST requests.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A development team is deciding on a CSRF defense for a web application that uses cookies for authentication. The application has both GET and POST state-changing endpoints. Which combination of defenses provides the strongest protection?

   • AUse a CSRF token only for POST requests and allow GET requests to be unauthenticated.
   • BUse SameSite=Lax cookies and rely on the browser's built-in CSRF protection.
   • CUse a CAPTCHA on every state-changing request.
   • DUse SameSite=Strict cookies and require a custom header for all state-changing requests.
   Reveal Solution Discussion Select an answer first