Cross Origin Policy Attacks and Mitigation GWEB Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A web application uses a double-submit cookie pattern for CSRF protection: a random token is set in a cookie and also submitted in a request header. The server validates that the two values match. The application does not use SameSite attributes. Which weakness could allow an attacker to bypass this defense?

   • AThe attacker can read the cookie via JavaScript because it lacks the HttpOnly flag.
   • BThe attacker can use a cross-site request forgery to submit the form without the header.
   • CThe attacker can set the cookie and header if the application has a subdomain that can set cookies for the parent domain.
   • DThe attacker can use a man-in-the-middle attack to modify the request.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A user is logged into a banking site. The user visits a malicious site that contains a form that auto-submits to the banking site's transfer endpoint. The banking site uses cookies for authentication and does not use anti-CSRF tokens. Which control would have prevented this attack?

   • ASetting the SameSite attribute to Strict on the session cookie.
   • BUsing a Content Security Policy that disallows form submissions.
   • CSetting the HttpOnly attribute on the session cookie.
   • DDisabling cookies and using HTTP Basic authentication.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company operates a public API that is used by multiple trusted partner applications. The API currently uses a wildcard Access-Control-Allow-Origin: * and does not use cookies. The security team wants to allow only the trusted partners to read responses while keeping the API accessible to all partners. Which configuration should be implemented?

   • AReplace the wildcard with a dynamic reflection of the Origin header.
   • BSet Access-Control-Allow-Origin to the API's own domain.
   • CAdd Access-Control-Allow-Credentials: true to the response.
   • DMaintain a server-side allowlist of partner origins and echo only those origins in the Access-Control-Allow-Origin header.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A web application uses session cookies for authentication and includes a form that changes the user's email address. The security team wants to mitigate CSRF without relying solely on the SameSite attribute. Which additional control is most effective?

   • AInclude a synchronizer token in the form that is validated against the session.
   • BValidate the Content-Type header of the request is application/x-www-form-urlencoded.
   • CSet the cookie's Secure flag to ensure it is only sent over HTTPS.
   • DCheck the Referer header and block requests from external domains.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the fundamental mechanism that enables a Cross-Site Request Forgery (CSRF) attack?

   • AThe browser automatically includes the victim's cookies in cross-origin requests, and the server cannot distinguish the request's origin.
   • BThe attacker injects malicious JavaScript into the victim's browser to forge requests.
   • CThe attacker is able to read the victim's cookies due to a cross-origin script.
   • DThe attacker uses a man-in-the-middle proxy to modify requests in transit.
   Reveal Solution Discussion Select an answer first