Which one of the following threat types to applications and services involves the sending of requests that are invalid and manipulated through a user's client to execute commands on the application…

The correct answer is D. Cross-site request forgery. Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser into sending forged HTTP requests to a web application, causing the application to execute unintended actions using the victim's own credentials and session. The attack exploits the trust a site has in the…

Submitted by javi_es· Apr 18, 2026Cloud Application Security

Question

Which one of the following threat types to applications and services involves the sending of requests that are invalid and manipulated through a user's client to execute commands on the application under the user's own credentials?

Options

AInjection
BMissing function-level access control
CCross-site scripting
DCross-site request forgery

How the community answered

(29 responses)

A
7% (2)
C
3% (1)
D
90% (26)

Explanation

Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser into sending forged HTTP requests to a web application, causing the application to execute unintended actions using the victim's own credentials and session. The attack exploits the trust a site has in the user's browser. Injection attacks insert malicious code into interpreters. Missing function-level access control exposes unprotected functions. Cross-site scripting (XSS) injects malicious scripts into web pages viewed by other users - the key differentiator for CSRF is that the request originates from the user's own client and executes under their credentials.

Topics

#Cross-site Request Forgery (CSRF)#Web Application Security#Application Threats#Client-side Attacks

Community Discussion

No community discussion yet for this question.

Full CCSP Practice