A security team is evaluating a web application that uses JSON for state-changing requests. The application relies on the Content-Type header being application/json to prevent CSRF. An attacker wants to bypass this defense. Which technique is most likely to succeed?

Use an image tag to send a GET request with JSON in the query string.

Use an XMLHttpRequest with the Content-Type set to application/x-www-form-urlencoded.

Use a fetch request with the Content-Type set to application/json.

Use a form with enctype='text/plain' to send a JSON payload.

A security engineer is reviewing a web application that uses a CSRF token stored in a cookie. The token is also submitted as a request parameter. The server validates that the parameter matches the cookie. The engineer discovers that the application has a subdomain that allows users to set arbitrary cookies. Which additional control would best mitigate the CSRF risk?

Validate the Origin header on all state-changing requests.

Add the SameSite=Lax attribute to the CSRF token cookie.

Switch to a synchronizer token stored in the session and rendered in a hidden form field.

Use a separate cookie name for the CSRF token that is not set by the subdomain.

A web application uses SameSite=Lax for its session cookie. A user logs in to the application and then visits a malicious website. The malicious website attempts to submit a POST form to the application to change the user's password. Which statement best describes the outcome?

The browser will send the session cookie because the user is logged in.

The browser will send the session cookie only if the request is a top-level navigation with a GET method.

The browser will not send the session cookie with the POST request, so the CSRF attack is blocked.

The browser will send the session cookie with the POST request, so the CSRF attack succeeds.

Which of the following is a common CSRF attack vector that uses a forged GET request?

An attacker uses JavaScript to read the response of a cross-origin request to steal data.

An attacker submits a form using the POST method to a third-party site to cause a state change.

An attacker exploits a cross-site scripting vulnerability to execute a script that sends a POST request.

An attacker embeds an image tag in a malicious website that points to a sensitive URL on the target application.

How does the SameSite cookie attribute help prevent CSRF attacks?

It restricts the browser from sending the cookie in cross-site requests, reducing the risk of CSRF.

It adds a custom header to all requests to indicate the request is same-origin.

It encrypts the cookie value so that the server can verify its authenticity.

It validates the origin of the request by checking the Referer header.

GIAC Certified Web Application Defender

Domain 3Objective 2

CSRF GWEB Practice Questions (Page 5)

Part of the Input Handling and Injection Flaws domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

4concepts

Questions 21–25

21expert · hard
A security team is evaluating a web application that uses JSON for state-changing requests. The application relies on the Content-Type header being application/json to prevent CSRF. An attacker wants to bypass this defense. Which technique is most likely to succeed?
Select an answer first
22expert · hard
A security engineer is reviewing a web application that uses a CSRF token stored in a cookie. The token is also submitted as a request parameter. The server validates that the parameter matches the cookie. The engineer discovers that the application has a subdomain that allows users to set arbitrary cookies. Which additional control would best mitigate the CSRF risk?
Select an answer first
23application · medium
A web application uses SameSite=Lax for its session cookie. A user logs in to the application and then visits a malicious website. The malicious website attempts to submit a POST form to the application to change the user's password. Which statement best describes the outcome?
Select an answer first
24foundation · easy
Which of the following is a common CSRF attack vector that uses a forged GET request?
Select an answer first
25foundation · easy
How does the SameSite cookie attribute help prevent CSRF attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.