How does the SameSite cookie attribute help mitigate CSRF attacks?

It prevents the browser from sending the cookie with cross-site requests.

It prevents JavaScript from accessing the cookie, reducing the risk of XSS.

It encrypts the cookie so that only the server can read it.

It ensures that the cookie is only sent over HTTPS connections.

Why does the server process a forged CSRF request as if it were legitimate?

Because the request originates from the same IP address as the victim's previous requests.

Because the server does not validate the Referer header by default.

Because the request includes the victim's valid session cookie, which the browser automatically attaches.

Because the attacker has obtained the victim's password and uses it to authenticate the request.

A web application has a CSRF vulnerability in a POST endpoint. The application uses SameSite=Lax cookies. The attacker wants to exploit this. Which condition is necessary for the attack to succeed?

The attacker must find a way to make the request same-site, such as using a subdomain

The victim must click a link that triggers a top-level navigation to the POST endpoint

The attacker must use a form with method=POST and auto-submit

The attacker must use a form with method=GET to the same endpoint

A user is logged into a social media site. The site has a feature to 'like' a post using a GET request. An attacker crafts a malicious link and tricks the user into clicking it. Which step is essential for the CSRF attack to succeed?

The malicious link must be sent over HTTPS

The user must have JavaScript enabled

The attacker must know the user's password

The user must be authenticated to the social media site

EC-CouncilWeb Application Hacking and Security

Domain 4Objective 1

Cross-Site Request Forgery (CSRF) - GET and POST Methods WAHS Practice Questions (Page 6)

Part of the Request Forgery Attacks domain, which makes up ~6% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

6concepts

Questions 26–30

26foundation · easy
How does the SameSite cookie attribute help mitigate CSRF attacks?
Select an answer first
27foundation · easy
Why does the server process a forged CSRF request as if it were legitimate?
Select an answer first
28foundation · easy
Which HTTP method is commonly exploited in CSRF attacks using simple HTML elements like `<img>` or `<a>`?
Select an answer first
29expert · hard
A web application has a CSRF vulnerability in a POST endpoint. The application uses SameSite=Lax cookies. The attacker wants to exploit this. Which condition is necessary for the attack to succeed?
Select an answer first
30application · medium
A user is logged into a social media site. The site has a feature to 'like' a post using a GET request. An attacker crafts a malicious link and tricks the user into clicking it. Which step is essential for the CSRF attack to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.