CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Prevent cross-site request forgery

  Why this is correct

  Cross-Site Request Forgery (CSRF) attacks trick authenticated users into submitting unintended requests to a web application, leveraging their existing session. CSRF tokens are unique, unpredictable, and secret values generated by the server and embedded within forms or request headers. Upon submission, the server validates the token, ensuring the request originated from the legitimate application and user, thereby preventing an attacker's forged request from being processed.

• ✗

  Prevent session hijacking

  Why it's wrong here

  Session hijacking involves an attacker gaining unauthorized access to a user's active session, typically by stealing or predicting their session ID. While CSRF tokens protect against forged requests *within* an active session, they do not prevent the initial compromise of the session itself. Robust session hijacking prevention relies on secure cookie attributes (HttpOnly, Secure, SameSite), strong session ID generation, regular session regeneration, and mandatory use of HTTPS to encrypt all communication and protect session tokens in transit.

• ✗

  Prevent XSS

  Why it's wrong here

  Cross-Site Scripting (XSS) attacks involve injecting malicious scripts into web pages viewed by other users, typically exploiting vulnerabilities in input validation or output encoding. CSRF tokens, designed to validate the authenticity of a request's origin, do not mitigate XSS. Effective XSS prevention relies on strict input sanitization, context-aware output encoding of all user-supplied data, and Content Security Policy (CSP) headers to restrict script execution.

• ✗

  Prevent SQL injection

  Why it's wrong here

  SQL injection attacks exploit vulnerabilities in an application's database queries, allowing attackers to inject malicious SQL code to manipulate or extract data. CSRF tokens operate at the application layer to verify user intent for state-changing requests and have no direct mechanism to prevent the manipulation of database queries. The primary defense against SQL injection is the use of parameterized queries or prepared statements, which separate SQL code from user-supplied data, preventing malicious input from being interpreted as executable commands.

Go deeper

Related to this question