Exam 312-50v11 topic 1 question 1 discussion

Compromising Session IDs Using Client-side Attacks Cross-site Request Forgery Attack (CSRF) Cross-site request forgery (CSRF), also known as a one-click attack or session riding. The Cross-Site Request Forgery (CSRF) attack exploits the victim’s active session with a trusted site to perform malicious activities. (P.1419/1403)

Was in Exam today 11/24/2021

Answer is C

Is the premium dump for the v12 a valid dump?

Is this dump still valid for the corrent exam?

Any update when this dump will be updated?

is this questions still valid?

It isn't CSRF, because there is no second website when the user clicks on the link. The link is received by email. Clicking a link to watch a cat movie, while actually triggering a money transfer sounds like clickbaiting to me. Answer A.

Answer is C

Clickjacking is a web security vulnerability where an attacker tricks a user into clicking on something different from what the user perceives. In this scenario, when the user clicked on the link in the email that seemed to lead to an interesting website with a cat video, the attacker exploited clickjacking to overlay that link with an invisible frame or layer that directed the user to a different action, such as initiating a fund transfer from the user's bank account. In this case, the attacker used the user's own browser to perform actions without the user's knowledge, making it appear as though the user initiated the actions, which include unauthorized fund transfers from the bank account. This technique allows the attacker to perform actions on a different site in the context of the user's active session.

The answer is C

Answer is C

Answer is C

C is the right for this one!

**CSRF** - tricks a web browser into executing an unwanted action in an application to which a user is already logged in. the attacker will typically use social engineering, such as an email or link that will trick a victim into sending a forger request to a server. **require a user to do something**. works only one way – it can only send HTTP requests, but **cannot view the response**.

Answer is C

Answer is C