Cross-Site Request Forgery (CSRF) - GET and POST Methods WAHS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement best describes how a CSRF attack occurs?

   • AThe attacker guesses the victim's password and logs in to the application to perform actions.
   • BThe attacker tricks the victim's browser into sending a forged request to a web application where the victim is authenticated.
   • CThe attacker injects malicious code into the target application to steal the victim's session token.
   • DThe attacker intercepts and modifies the victim's request in transit to change the action performed.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A development team is migrating a legacy application that uses GET requests for state changes to a modern framework. They want to implement CSRF protection with minimal code changes. Which approach is most effective?

   • AChange all state-changing actions to POST and implement anti-CSRF tokens
   • BKeep GET requests and add anti-CSRF tokens as query parameters
   • CUse SameSite=Strict cookies only
   • DUse custom headers on all requests
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A user is logged into a web application that allows changing account details via GET requests. The user visits a forum where an attacker has posted a message with an <img> tag pointing to a URL that changes the user's email. The user's email is changed. Which statement best describes why this attack succeeded?

   • AThe browser automatically included the user's session cookie with the image request, and the server processed it as a legitimate action.
   • BThe attacker was able to read the user's session cookie from the image request.
   • CThe image tag bypassed the same-origin policy, allowing the attacker to execute JavaScript in the user's browser.
   • DThe server failed to validate the Referer header, which is the primary defense against CSRF.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a potential impact of a successful CSRF attack?

   • AThe attacker can read sensitive data from the victim's account.
   • BThe attacker can modify the victim's account details, such as email address or password.
   • CThe attacker can execute arbitrary code on the victim's browser.
   • DThe attacker can steal the victim's session cookie and impersonate them.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does an attacker execute a POST-based CSRF attack?

   • ABy using a link that the victim clicks to trigger a POST request.
   • BBy embedding a URL in an image tag that sends a POST request to the target.
   • CBy sending a POST request directly from the attacker's server to the target application.
   • DBy crafting an HTML form that auto-submits via JavaScript when the page loads.
   Reveal Solution Discussion Select an answer first