CEH Web Application and Injection Attacks Practice Question
Which THREE of the following are valid defenses against CSRF attacks? (Select 3)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Custom request headers (e.g., X-Requested-With)
CSRF tokens, SameSite cookies (Lax or Strict), and custom headers (e.g., X-Requested-With with XMLHttpRequest) are all effective CSRF defenses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Custom request headers (e.g., X-Requested-With)
Why this is correct
Custom request headers like X-Requested-With serve as an effective CSRF defense by leveraging browser security mechanisms. Modern browsers, adhering to the Same-Origin Policy and CORS specifications, prevent attackers from arbitrarily adding or modifying such custom headers in simple cross-origin requests. The server can then validate the presence and expected value of this header, rejecting any request originating from an unauthorized domain that lacks the legitimate header. This ensures that only requests from the legitimate origin, which can set the header, are processed.
- ✓
SameSite cookies set to Lax or Strict
Why this is correct
Setting SameSite cookies to Lax or Strict significantly mitigates CSRF by controlling when cookies are sent with cross-site requests. The Strict attribute entirely prevents cookies from being sent with any cross-site navigation, while Lax allows them only for top-level navigations using safe HTTP methods like GET. This ensures that an attacker's forged POST request from a different origin will not carry the victim's session cookie, thereby failing authentication on the server and preventing the malicious action.
- ✓
CSRF tokens
Why this is correct
CSRF tokens, typically implemented using the synchronizer token pattern, are a robust defense where a unique, unpredictable, and user-specific secret value is generated server-side and embedded within forms or AJAX requests. This token is then validated upon submission; if the token is missing or incorrect, the request is rejected. Since an attacker cannot obtain this secret token from the victim's browser in a cross-site context, they cannot successfully forge a valid request that includes the necessary token.
- ✗
Input validation
Why it's wrong here
Input validation focuses on ensuring that data submitted by a user conforms to expected formats, types, and ranges, preventing issues like SQL injection or buffer overflows. However, it does not address the fundamental problem of CSRF, which is the unauthorized initiation of a request from a trusted user's browser. A malicious, forged request containing perfectly valid input would still be executed by the server if not for other CSRF defenses, as input validation only checks the data's integrity, not the request's legitimacy or origin.
- ✗
Output encoding
Why it's wrong here
Output encoding is a crucial defense against Cross-Site Scripting (XSS) attacks, transforming potentially malicious characters in user-supplied data into a safe representation before rendering it in a web page. This prevents the browser from interpreting encoded data as executable code. However, output encoding does not protect against CSRF, as CSRF exploits the browser's automatic inclusion of session cookies with requests to a trusted site, not vulnerabilities in how data is displayed or interpreted by the browser's rendering engine.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.