CEH Web Application and Injection Attacks Practice Question
An attacker wants to perform a CSRF attack against a banking application. The application uses SameSite cookies set to 'Strict'. The attacker hosts a malicious page on their own domain. When the victim visits the malicious page, which of the following statements is TRUE regarding the CSRF attack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The attack will fail because the browser will not include the session cookie with the cross-origin request.
SameSite=Strict prevents cookies from being sent on cross-site requests, effectively blocking CSRF attacks if the attacker cannot control the origin.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The attack will succeed because cookies are sent regardless of SameSite settings.
Why it's wrong here
The premise that cookies are sent regardless of SameSite settings is incorrect. When a cookie is set with SameSite=Strict, the browser explicitly prevents that cookie from being sent with any cross-site request, regardless of the request method. This security measure is specifically designed to mitigate CSRF attacks by ensuring session identifiers are only transmitted in same-site contexts, directly contradicting the option's claim.
- ✗
The attack will succeed because the attacker can bypass SameSite using GET requests.
Why it's wrong here
The assertion that SameSite can be bypassed using GET requests is false. The SameSite attribute applies its restrictions to all types of HTTP requests, including GET, POST, PUT, and DELETE. While SameSite=Lax might permit GET requests for top-level navigations, SameSite=Strict rigorously blocks cookie inclusion for *all* cross-site requests, making the request method irrelevant for bypassing this strong protection against CSRF.
- ✗
The attack will fail because CSRF requires POST requests and the malicious page only uses GET.
Why it's wrong here
The claim that CSRF attacks exclusively require POST requests is a common misconception. Cross-site Request Forgery can be effectively executed using various HTTP methods, including GET requests, often embedded within <img> tags, <a> links, or <iframe> elements. The crucial factor for a CSRF attack's success is the browser automatically including the user's session cookie with the forged request, which SameSite protection aims to prevent irrespective of the request method.
- ✓
The attack will fail because the browser will not include the session cookie with the cross-origin request.
Why this is correct
This statement accurately describes how SameSite=Strict thwarts a CSRF attempt. When a user visits a malicious website, and that site tries to forge a request to the banking application, the browser recognizes this as a cross-origin request. Because the banking application's session cookie is configured with SameSite=Strict, the browser will deliberately omit this crucial authentication cookie from the outgoing request, rendering the forged request unauthenticated and ineffective.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.