What is the primary purpose of an anti-CSRF token?

To authenticate the user by verifying their password on each request.

To encrypt the request body so that only the server can read it.

To prevent cross-site scripting (XSS) attacks by sanitizing user input.

To ensure that the request contains a unique value that an attacker cannot predict or obtain.

A development team is reviewing a web application that handles both GET and POST state-changing requests. They want to implement a defense that blocks CSRF attacks without requiring user interaction changes. Which control is most effective across both methods?

Require the request to include a custom header like X-Requested-With

Check the Referer header on every request

Use a synchronizer token pattern with a hidden field in forms

A security team is reviewing a web application that uses a double-submit cookie pattern for CSRF protection. The token is stored in a cookie and also in a hidden form field. The server checks that both values match. Which weakness is inherent in this pattern?

The token is sent in a query parameter, which is logged

If the attacker can set a cookie on the victim's browser, they can forge the token

The token is not tied to the session, so it can be reused

The token is stored in a cookie, so it is vulnerable to XSS

How can an attacker use an image tag to perform a GET-based CSRF attack?

By setting the `src` attribute to a data URI that contains JavaScript to execute in the victim's browser.

By using the image tag to upload a malicious file to the server.

By embedding a URL in the `src` attribute that triggers a state-changing action when the browser loads the image.

By using the `onerror` event to send a POST request to the target application.

What is the purpose of using hidden input fields in a CSRF attack form?

To bypass same-origin policy restrictions on form submissions.

To include the necessary parameters that the target application expects in the POST request.

To store the victim's session cookie in the form for submission.

To hide the form from the victim so they do not see the attack occurring.

EC-CouncilWeb Application Hacking and Security

Domain 4Objective 1

Cross-Site Request Forgery (CSRF) - GET and POST Methods WAHS Practice Questions (Page 2)

Part of the Request Forgery Attacks domain, which makes up ~6% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

6concepts

Questions 6–10

6foundation · easy
What is the primary purpose of an anti-CSRF token?
Select an answer first
7application · medium
A development team is reviewing a web application that handles both GET and POST state-changing requests. They want to implement a defense that blocks CSRF attacks without requiring user interaction changes. Which control is most effective across both methods?
Select an answer first
8expert · hard
A security team is reviewing a web application that uses a double-submit cookie pattern for CSRF protection. The token is stored in a cookie and also in a hidden form field. The server checks that both values match. Which weakness is inherent in this pattern?
Select an answer first
9foundation · easy
How can an attacker use an image tag to perform a GET-based CSRF attack?
Select an answer first
10foundation · easy
What is the purpose of using hidden input fields in a CSRF attack form?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.