Cross Origin Policy Attacks and Mitigation GWEB Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a recommended defense-in-depth strategy to mitigate CSRF attacks?

   • AUse only SameSite cookies and do not implement anti-CSRF tokens.
   • BImplement both anti-CSRF tokens and SameSite cookies, and validate the Origin header for state-changing requests.
   • CDisable cookies entirely to prevent them from being sent with cross-origin requests.
   • DUse a web application firewall (WAF) to block all cross-origin requests.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the role of the Access-Control-Allow-Origin (ACAO) header in CORS?

   • AIt tells the browser which origins are permitted to read the response to a cross-origin request.
   • BIt encrypts the response to ensure confidentiality during cross-origin communication.
   • CIt tells the server which origins are allowed to send requests to it.
   • DIt prevents cross-origin requests from being sent at all.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of the same-origin policy in web browsers?

   • ATo ensure that all web pages are served over HTTPS to prevent man-in-the-middle attacks
   • BTo allow a web page to freely read data from any other origin to enable mashups
   • CTo isolate web content from different origins so that scripts from one origin cannot access data from another without explicit permission
   • DTo prevent a web page from making any network requests to other origins
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security review finds that an API returns Access-Control-Allow-Origin: null for requests with an Origin header of 'null'. The API also allows credentials. Which attack scenario is most likely to exploit this misconfiguration?

   • AA sandboxed iframe from a malicious site sends a request with Origin: null and reads the response.
   • BA cross-site request forgery attack using a form submission to the API.
   • CA malicious browser extension that modifies the Origin header to null.
   • DA DNS rebinding attack that changes the Origin header to the API's own domain.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A web application uses session cookies for authentication and has implemented anti-CSRF tokens. A penetration tester discovers that the tokens are not validated on all state-changing endpoints. Which additional control would provide defense-in-depth against CSRF?

   • ADisable CORS on the application.
   • BUse a Content Security Policy that disallows inline scripts.
   • CSet the SameSite attribute to Strict on the session cookie.
   • DSet the HttpOnly attribute on the session cookie.
   Reveal Solution Discussion Select an answer first