CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Anti-CSRF token

  Why it's wrong here

  Anti-CSRF tokens are security mechanisms designed to prevent Cross-Site Request Forgery attacks by including a unique, secret, and unpredictable token in web requests. This token ensures that requests originate from the legitimate user's browser and are intended by the user, validating the request's origin rather than the validity of input credentials. Consequently, they do not mitigate username enumeration, which exploits differing server responses to distinguish between valid and invalid usernames.

• ✗

  Account lockout policy

  Why it's wrong here

  An account lockout policy is a security control that automatically disables or temporarily locks a user account after a predefined number of consecutive failed login attempts. While highly effective against brute-force password guessing attacks, this policy does not inherently prevent username enumeration when the application provides distinct error messages for invalid usernames versus invalid passwords. The lockout mechanism only activates after a valid username has been identified and multiple password attempts have failed, not during the initial username validation phase.

• ✓

  Generic error messages

  Why this is correct

  Generic error messages, such as "Invalid username or password," are a crucial defense against username enumeration vulnerabilities. By providing the exact same response regardless of whether the submitted username is valid but the password is wrong, or if the username itself does not exist in the system, the application denies attackers the ability to differentiate between these two states. This ambiguity prevents an attacker from systematically testing a list of potential usernames to identify which ones are registered within the system.

• ✗

  Rate limiting

  Why it's wrong here

  Rate limiting is a security measure that restricts the number of requests a client can make to a server within a specific time frame, primarily to prevent brute-force attacks, denial-of-service, or excessive resource consumption. While effective at slowing down enumeration attempts by limiting the speed at which an attacker can test usernames, it does not fundamentally address the underlying vulnerability if the application still provides distinct error messages for valid versus invalid usernames. An attacker could still enumerate users, albeit at a much slower pace, by observing the differing responses within the allowed request limits.