CEH Web Application and Injection Attacks Practice Question
Which of the following is the most effective defense against Cross-Site Request Forgery (CSRF) attacks?
⚠ Common exam trap
EC-Council often tests the misconception that input validation or CSP can prevent CSRF, when in fact CSRF exploits the browser's automatic inclusion of credentials (cookies) and requires a server-side token or SameSite cookie attribute to verify request intent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CSRF tokens
CSRF tokens are the most effective defense because they are unique, unpredictable values embedded in each form or request that the server validates. Without a valid token, the server rejects the request, preventing an attacker from forging a legitimate user's action even if the victim is authenticated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Content Security Policy (CSP)
Why it's wrong here
Content Security Policy (CSP) is designed to mitigate Cross-Site Scripting (XSS) and other client-side injection attacks by specifying which content sources (scripts, stylesheets, images, etc.) a web page is permitted to load and execute. While effective against unauthorized script execution, CSP does not prevent Cross-Site Request Forgery (CSRF) because CSRF attacks leverage a victim's authenticated session to submit a legitimate, albeit malicious, request to the target server, which CSP's resource loading restrictions do not intercept or validate.
- ✓
CSRF tokens
Why this is correct
CSRF tokens are the most effective defense against Cross-Site Request Forgery (CSRF) attacks. These unique, unpredictable, and secret values are generated server-side for each user session and embedded within critical state-changing requests, such as form submissions. The server then validates the presence and correctness of this token upon receiving the request, ensuring that the request originated from the legitimate application and not from an attacker's malicious site.
- ✗
Rate limiting
Why it's wrong here
Rate limiting is a security measure primarily used to prevent brute-force attacks, denial-of-service (DoS) attacks, and resource exhaustion by restricting the number of requests a user or IP address can make within a specified timeframe. While effective for these purposes, it offers no direct protection against Cross-Site Request Forgery (CSRF) because a CSRF attack typically involves a single, legitimate-looking request initiated by the victim's browser, which would not exceed typical rate limits.
- ✗
Input validation
Why it's wrong here
Input validation is a crucial security control that ensures data submitted by users conforms to expected formats, types, and ranges, thereby preventing injection attacks like SQL injection, command injection, and Cross-Site Scripting (XSS). However, it does not defend against Cross-Site Request Forgery (CSRF) because CSRF exploits the trust a web application has in an authenticated user's browser, coercing the user to perform an unintended action with valid, well-formed input, rather than injecting malicious data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.