Which is the description of CSRF (Cross-Site Request Forgery)?

Option D describes CSRF: an attacker tricks a user into performing unintended actions on a website where the user is authenticated, typically by embedding malicious scripts or requests. Options A, B, and C describe other attack types: A describes a DDoS amplification attack, B describes XSS (Cross-Site Scripting), and C describes SQL Injection—none of which are CSRF.

Step-by-step Derivation:
CSRF works by exploiting the user's authenticated session without their knowledge. The attacker crafts a malicious request (often embedded in a webpage or script) that the victim's browser automatically executes because the victim is already logged into the target site. This leverages the browser's automatic inclusion of authentication cookies. Option D captures this mechanism of running 'unintended operations' via malicious embedded content. The other options conflate CSRF with different web vulnerabilities: DDoS attacks (A), XSS (B), and SQL Injection (C).