PEN-200 Client-Side Attacks Practice Question
During a penetration test, you want to exploit a client-side vulnerability by sending a link that will execute JavaScript in a victim’s browser when clicked. The target application uses a session cookie without the SameSite attribute. Which attack is most directly enabled by the missing SameSite attribute?
⚠ Common exam trap
Many exam-takers confuse cookie transmission controls with script injection flaws, assuming that a missing SameSite attribute enables XSS rather than CSRF.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cross-Site Request Forgery (CSRF)
The SameSite cookie attribute controls whether cookies are sent with cross-site requests. Without it, a browser may include the session cookie when a victim’s browser makes a request to the target site from a different origin. An attacker can exploit this by crafting a page that automatically submits a state-changing request, such as a form POST, to the target application. The server sees the authenticated cookie and processes the action, which is the essence of CSRF.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Clickjacking
Why it's wrong here
Clickjacking involves tricking a user into clicking a hidden or disguised element, often using an iframe. It is mitigated by X-Frame-Options or CSP frame-ancestors, not by the SameSite cookie attribute. SameSite controls cookie transmission across sites, so its absence does not directly enable clickjacking. A clickjacking attack can work regardless of cookie attributes.
- ✗
Reflected Cross-Site Scripting (XSS)
Why it's wrong here
Reflected XSS occurs when user input is immediately returned in a response without proper encoding. The absence of the SameSite attribute does not cause or enable XSS. XSS is a code injection flaw in the application, while SameSite governs when cookies are attached to cross-site requests. These are separate issues, and SameSite does not prevent script execution.
- ✗
DOM-based Cross-Site Scripting (XSS)
Why it's wrong here
DOM-based XSS arises when client-side JavaScript processes attacker-controlled data and writes it to a dangerous sink. The SameSite attribute has no role in DOM-based XSS, as the vulnerability is in the client-side code itself. Missing SameSite affects cookie behavior, not the execution of injected scripts. Therefore, it does not directly enable DOM-based XSS.
- ✓
Cross-Site Request Forgery (CSRF)
Why this is correct
When a session cookie lacks the SameSite attribute, browsers may send it with cross-site requests. This allows an attacker to craft a malicious page that submits a request to the target application, and the victim’s browser automatically includes the session cookie. The server then processes the request as the authenticated user, enabling CSRF. SameSite is a primary defense against this class of attack.
About these practice questions
One of 285 original PEN-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.