Q18 /20 Which is the description of CSRF (Cross-Site Request Forgery)?

CSRF is an attack where an attacker tricks a user into performing unintended actions on another website where the user is authenticated, typically by embedding malicious code that executes in the victim's browser. Option D correctly describes this mechanism. Option B describes XSS (Cross-Site Scripting), Option C describes SQL Injection, and Option A describes a DDoS/botnet attack—none of which are CSRF.

Step-by-step Derivation:
CSRF (Cross-Site Request Forgery) works by:

1. Attacker crafts a malicious request targeting a different website
2. Victim visits a page containing the malicious code/link
3. The victim's browser automatically sends the request with their authentication credentials
4. Unintended action executes on the victim's behalf on the target site

Option D captures this core mechanism: visitors encounter malicious content that causes their browser to perform operations they didn't intend. Options A (DDoS), B (XSS), and C (SQL Injection) describe different attack types entirely.