Cross-Site Request Forgery is a malicious mechanism in which an attacker uses a person's authentication information to force actions on a website.

Cross-Site Request Forgery is a malicious mechanism in which an attacker uses a person's authentication information to force actions on a website.

• A. CSRF
• B. Cursor
• C. Database
• D. DDL

Answer: (A)

This question tests understanding of Cross-Site Request Forgery, where an attacker exploits a user’s existing authenticated session to trigger actions on a website without the user’s intention. When a user is logged in, their browser sends authenticated requests (via cookies or tokens). If the user visits a malicious page or image source that silently makes a request to the trusted site, the site may perform the action using the user’s credentials, since it can’t tell who initiated the request. That’s dangerous because it can do things with the user’s privileges—like transferring money or changing settings—without the user realizing it. Defenses include anti-CSRF measures such as tokens that must be submitted with sensitive requests, SameSite cookies, and validating the request’s origin or requiring additional user confirmation for critical actions. The other terms listed—cursor, database, and DDL—don’t describe this scenario: a cursor is a database traversal mechanism, a database is a storage system, and DDL defines database schemas; none involve tricking a browser into performing actions through an authenticated session.

This question tests understanding of Cross-Site Request Forgery, where an attacker exploits a user’s existing authenticated session to trigger actions on a website without the user’s intention. When a user is logged in, their browser sends authenticated requests (via cookies or tokens). If the user visits a malicious page or image source that silently makes a request to the trusted site, the site may perform the action using the user’s credentials, since it can’t tell who initiated the request. That’s dangerous because it can do things with the user’s privileges—like transferring money or changing settings—without the user realizing it. Defenses include anti-CSRF measures such as tokens that must be submitted with sensitive requests, SameSite cookies, and validating the request’s origin or requiring additional user confirmation for critical actions. The other terms listed—cursor, database, and DDL—don’t describe this scenario: a cursor is a database traversal mechanism, a database is a storage system, and DDL defines database schemas; none involve tricking a browser into performing actions through an authenticated session.