Which is the description of CSRF (Cross-Site Request Forgery)?
Accenture technical mcq question, verified with a worked answer. Free to practise - no sign-up.
Which is the description of CSRF (Cross-Site Request Forgery)?
Show answer & explanation
Answer: D. An attack that allows an attacker to execute unintended operations on a victim's browser by tricking them into making requests to a different website where they are authenticated.
CSRF exploits the trust a web application has in an authenticated user's browser to perform unauthorized actions on their behalf without their knowledge. The attacker tricks the victim into clicking a link or visiting a page that makes an unwanted request to another site. Options A, B, and C describe other attack types: A is a DDoS variant, B is XSS (Cross-Site Scripting), and C is SQL injection or input validation attacks.
Step-by-step Derivation:
CSRF definition breakdown:
- CSRF requires the victim to be authenticated on a target website
- The attacker crafts a malicious request (link, image, form) on their own site or injected content
- When the victim visits, their browser automatically includes their authentication credentials
- The target website processes the request as legitimate because it comes from an authenticated session
- The victim unknowingly performs actions they didn't intend (transfer money, change password, etc.)
Analyzing the given options:
- A: Describes a DDoS or worm propagation attack, not CSRF
- B: Describes XSS (Cross-Site Scripting) — malicious script in input forms
- C: Describes SQL injection or input validation bypass attacks
- D (repaired): Correctly describes CSRF — the key element is the unintended operations performed because of the victim's authenticated session on another site