Discuss GAQM CFA-001 Exam Topic 4 Question 39

Identify the attack from following sequence of actions?

Step 1: A user logs in to a trusted site and creates a new session

Step 2: The trusted site stores a session identifier for the session in a cookie in the web browser

Step 3: The user is tricked to visit a malicious site

Step 4: the malicious site sends a request from the user's browser using his session cookie

AWeb Application Denial-of-Service (DoS) Attack

BCross-Site Scripting (XSS) Attacks

CCross-Site Request Forgery (CSRF) Attack

DHidden Field Manipulation Attack

Suggested Answer: C

Get Premium CFA-001 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

14 comments · newest first

Adria 12 months ago

I thought XSS was more common for this kind of thing?

Roslyn 12 months ago

This is textbook CSRF, easy to exploit.

Viki 1 year ago

Wait, how can they use the session cookie like that?

Elvis 1 year ago

Definitely CSRF, no doubt about it!

Fanny 1 year ago

Sounds like a classic CSRF attack.

Davida 1 year ago

I remember CSRF being about unauthorized actions using a user's session, so I think that's the right answer here.

Glenna 1 year ago

I feel like this is definitely not a DoS attack, but I can't recall the exact differences between CSRF and hidden field manipulation.

Shanda 1 year ago

I'm not entirely sure, but it sounds similar to the XSS questions we practiced. However, I remember CSRF involves using cookies too.

Nikita 1 year ago

I think this might be a CSRF attack since the user is tricked into visiting a malicious site that uses their session cookie.

Linn 1 year ago

Okay, let's think this through step-by-step. We need to configure two advanced WLAN settings for a BYOD wireless network with a dual SSID approach.

Gwenn 1 year ago

This question seems straightforward, but I want to make sure I understand the differences between audits and management reviews before selecting an answer.

Elvera 1 year ago

Hmm, I'm not totally sure about this one. I'll need to review the ISO 27002 standard to make sure I understand the access control requirements.

Rebeca 1 year ago

This seems like a tricky one. I'll need to think through the different control functions and which one would be the least effective.

Carla 1 year ago

I'm leaning towards blue for the run lines. I remember a similar question from the practice exam; just not sure if it's correct.

GAQM CFA-001 Exam - Topic 4 Question 39 Discussion