CSRF GWEB Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following best describes the potential impact of a successful CSRF attack on a web application?

   • AThe attacker gains direct access to the victim's session token and can impersonate them in future requests.
   • BThe attacker can execute arbitrary code on the server, leading to full system compromise.
   • CThe attacker can read sensitive data stored in the application, such as personal information or credit card numbers.
   • DThe attacker can perform unauthorized state-changing actions on behalf of the victim, such as changing email or transferring funds.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A web application has a feature that allows users to delete their account via a GET request to /delete-account. An attacker wants to trick a victim into deleting their account. Which attack vector is the most likely to succeed?

   • ASending a link to the victim and hoping they click it.
   • BEmbedding an image tag with src='https://victim-site/delete-account' in a page the victim visits.
   • CUsing a form that auto-submits a POST request to the endpoint.
   • DUsing JavaScript to send a fetch request with the credentials option set to 'include'.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's web application uses a double-submit cookie pattern for CSRF defense. The application sets a random token in a cookie and also includes the same token in a hidden form field. A security review flags that the token is predictable. What is the most appropriate remediation?

   • ARemove the cookie and rely solely on the hidden field.
   • BUse a static token value for all users to simplify validation.
   • CEncode the token using base64 to make it harder to guess.
   • DGenerate the token using a cryptographically secure random number generator and ensure it is unique per session.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is explaining CSRF to a new developer. The developer asks: 'Why can't the attacker just read the CSRF token from the victim's browser?' Which response is most accurate?

   • AThe Same-Origin Policy prevents the attacker's site from reading the victim's cookies or page content on the target site.
   • BThe token is encrypted, so the attacker cannot decrypt it.
   • CThe token is only sent over HTTPS, so the attacker cannot intercept it.
   • DThe attacker can read the token if the victim's browser has a plugin installed.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When testing a web application for CSRF, which of the following is a key indicator that the application is vulnerable?

   • AThe application uses HTTPS to encrypt all traffic.
   • BThe application does not validate the anti-CSRF token on state-changing requests.
   • CThe application uses a POST request to change the user's email address.
   • DThe application sets the SameSite attribute to 'Strict' on session cookies.
   Reveal Solution Discussion Select an answer first