CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Using anti-CSRF tokens

  Why this is correct

  Anti-CSRF tokens are unique, unpredictable, secret values generated by the server and embedded into forms or AJAX requests. When a user submits a request, the server verifies that the token received matches the one issued for that specific session. This mechanism prevents attackers from forging requests, as they cannot predict or obtain the valid token required for a successful submission from the legitimate user's browser session. Without a valid token, the server rejects the request, effectively blocking the CSRF attack.

• ✓

  Setting the SameSite attribute on cookies

  Why this is correct

  The `SameSite` attribute on cookies instructs web browsers to restrict when cookies are sent with cross-site requests. By setting this attribute to `Lax` or `Strict`, the browser will prevent the session cookie from being automatically included in third-party contexts, such as an attacker's malicious website making a request to the legitimate site. This significantly mitigates CSRF by ensuring that authentication credentials, typically stored in session cookies, are not inadvertently sent with requests originating from different domains.

• ✗

  Enabling HTTP Strict Transport Security (HSTS)

  Why it's wrong here

  HTTP Strict Transport Security (HSTS) is a security policy mechanism that helps protect websites against downgrade attacks and cookie hijacking by forcing browsers to interact with the server only over HTTPS. While crucial for enforcing encrypted communication and preventing man-in-the-middle attacks, HSTS does not prevent Cross-Site Request Forgery (CSRF). A CSRF attack exploits the browser's trust in a user's authenticated session, regardless of whether the communication is encrypted, meaning a forged request sent over HTTPS would still be processed if the session cookie is included.

• ✗

  Implementing input validation on all user inputs

  Why it's wrong here

  Input validation is a critical security measure designed to ensure that data submitted by users conforms to expected formats and types, preventing vulnerabilities like SQL injection or Cross-Site Scripting (XSS). However, it does not directly defend against Cross-Site Request Forgery (CSRF) attacks. CSRF exploits the browser's automatic inclusion of session cookies with requests to a trusted site, not malformed input. A valid, but unauthorized, request initiated by an attacker through the victim's browser would still pass input validation checks.

• ✗

  Using Content Security Policy (CSP) headers

  Why it's wrong here

  Content Security Policy (CSP) is a security mechanism that helps mitigate various types of attacks, primarily Cross-Site Scripting (XSS), by specifying which content sources (e.g., scripts, stylesheets, images) are permitted to be loaded and executed by the browser. While highly effective against client-side injection vulnerabilities, CSP does not directly prevent Cross-Site Request Forgery (CSRF). CSRF attacks involve forging requests that appear legitimate to the server, originating from the victim's browser, rather than injecting malicious scripts or content into the page itself.

Go deeper

Related to this question