Cross-Site Request Forgery Attacks Quiz

What is the term used for injecting JavaScript into a user's web browser through page elements like comment sections, search results, and URLs?

• Phishing

• Cross-Site Request Forgery

• Cross-Site Scripting

• SQL Injection

What vulnerability do attackers exploit to steal Gmail contact lists, trigger one-click purchases on Amazon, and change router configuration?

• Cross-Site Scripting

• Cross-Site Request Forgery

• Phishing

• SQL Injection

What design philosophy, recommends using GET requests only to fetch web pages or other resources?

• SOAP

• REST

• GraphQL

• RPC

What is the purpose of anti-CSRF cookies in protecting against CSRF attacks?

• To validate HTTP requests made from JavaScript

• To ensure that GET requests originate from the same domain

• To strip cookies on requests generated from external domains

• To force reauthentication for sensitive actions

What attribute is specified when setting cookies to strip cookies on requests generated from external domains?

• Secure

• Path

• HttpOnly

• SameSite

What is the purpose of setting the SameSite attribute to Lax for cookies?

• To prevent cookies from being accessed by JavaScript

• To ensure cookies are sent only with requests initiated from within the same site

• To allow sending of cookies from some cross-site requests

• To force reauthentication for sensitive actions

What is the benefit of requiring reauthentication for sensitive actions on a website?

• To allow seamless linking into the site

• To improve user experience

• To protect against cross-site scripting attacks

• To add an additional layer of protection against CSRF attacks

What is the primary solution to protect against cross-site request forgery attacks?

• Requiring reauthentication for all actions

• Defusing GET requests and using anti-CSRF cookies

• Using secure passwords

• Implementing anti-virus software

What is the primary vulnerability that attackers exploit in cross-site request forgery attacks?

• GET requests that changes server state

• Vulnerable server software

• Weak encryption algorithms

• Insecure network protocols

What is the purpose of using anti-CSRF cookies to validate HTTP requests made from JavaScript?

• To protect against requests using other HTTP verbs

• To verify that POST requests originate from pages hosted on the same web domain

• To strip cookies on requests generated from external domains

• To ensure that GET requests originate from the same domain