CISSP Software Development Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Setting cookies with the SameSite attribute to Strict

  Why this is correct

  The SameSite=Strict attribute on cookies ensures that the browser will only send the cookie with requests originating from the same site as the cookie's domain. This effectively prevents a malicious third-party site from tricking a user's browser into sending authenticated requests to the legitimate application, thereby mitigating Cross-Site Request Forgery (CSRF) attacks. It provides a robust defense by restricting cookie transmission to first-party contexts only.

• ✓

  Using anti-CSRF tokens in forms

  Why this is correct

  Anti-CSRF tokens are unique, unpredictable, and session-specific values embedded within web forms or request parameters. The server generates these tokens and associates them with the user's session, then validates their presence and correctness upon form submission. If a request lacks a valid token, or if the token does not match the server's expectation, the request is rejected, effectively preventing an attacker from forging legitimate requests.

• ✗

  Using HTTPS for all pages

  Why it's wrong here

  While using HTTPS for all pages is crucial for protecting data confidentiality and integrity during transit, it does not directly prevent Cross-Site Request Forgery (CSRF) attacks. HTTPS encrypts the communication channel between the client and server, preventing eavesdropping and tampering. However, CSRF exploits the browser's trust in the user's authenticated session, not the security of the transport layer itself, allowing a forged request to be sent over an encrypted connection.

• ✗

  Enforcing strong password policies

  Why it's wrong here

  Enforcing strong password policies is a fundamental security practice that helps protect user accounts from brute-force attacks, dictionary attacks, and credential stuffing. However, strong passwords do not offer any protection against Cross-Site Request Forgery (CSRF). CSRF attacks exploit a user's active, authenticated session by tricking their browser into sending a request, rather than attempting to guess or compromise their login credentials.

• ✗

  Implementing input validation on all user inputs

  Why it's wrong here

  Implementing robust input validation on all user inputs is essential for preventing a wide range of vulnerabilities, such as SQL injection, Cross-Site Scripting (XSS), and command injection, by ensuring that data conforms to expected formats and types. However, input validation does not prevent Cross-Site Request Forgery (CSRF). CSRF attacks bypass the need for malicious input by leveraging the user's browser to send legitimate-looking requests, regardless of the input's validity.

Go deeper

Related to this question