CA1-005: CompTIA SecurityXDemo

By CompTIA · Question Mode

QuestionQ70

Security Engineering

A company performs a DAST scan of a web application. The tool provides these recommendations:

  • Use cookie prefixes.
  • Content Security Policy - SameSite=strict is not configured.

Which vulnerability has the tool identified?

  • A RCE
  • B XSS
  • C CSRF
  • D TOCTOU
Explanation

CSRF relies on a victim’s browser automatically including authenticated cookies in a cross-site request. Setting SameSite=Strict prevents that cross-site cookie inclusion, and cookie prefixes can further protect cookie-based CSRF mechanisms.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!