Clickjacking WAHS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is using a browser extension to test a web application for clickjacking. The extension reports that the application is vulnerable because it does not send X-Frame-Options headers. What should the analyst do next to validate the finding?

   • AManually attempt to load the application's page in an iframe on a test page and verify it renders
   • BRun a network scan to check for open ports
   • CCheck the application's source code for any JavaScript that prevents framing
   • DReview the application's authentication mechanism
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A web application currently uses a frame-busting script to prevent clickjacking. A security consultant notes that the script can be bypassed by using the sandbox attribute on the iframe. Which more robust defense should the consultant recommend?

   • AIncrease the complexity of the frame-busting script by adding more checks
   • BUse a CAPTCHA on all sensitive actions
   • CDisable JavaScript in the application's pages
   • DAdd the X-Frame-Options: DENY header to all responses
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is manually testing a web application for clickjacking. The analyst creates a simple HTML page with an iframe that loads the target application and opens it in a browser. The iframe displays the target application normally, and clicking inside the iframe works as expected. What does this result indicate?

   • AThe test is inconclusive because the analyst did not use a transparent overlay.
   • BThe application is likely vulnerable to clickjacking because it does not prevent being loaded in an iframe.
   • CThe application is using frame-busting scripts that only work in certain browsers.
   • DThe application is secure because the iframe is visible and the user can see what they are clicking.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A web developer is troubleshooting a clickjacking defense. The application sends the header 'Content-Security-Policy: frame-ancestors https://trusted.com' on all pages. However, when the developer tests the application by loading it in an iframe from https://trusted.com, the page does not load. The developer checks the browser console and sees an error about the frame-ancestors directive. What is the most likely cause of this issue?

   • AThe browser does not support the CSP frame-ancestors directive, so it is blocking all framing.
   • BThe application is also sending an 'X-Frame-Options: DENY' header, which takes precedence over the CSP directive.
   • CThe browser is enforcing the CSP directive, but the developer is testing from a different origin (e.g., http://trusted.com or https://www.trusted.com) that is not listed in the directive.
   • DThe developer has a browser extension that is blocking the iframe for security reasons.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester is using a browser extension to test for clickjacking. The extension allows the tester to load a target URL inside an iframe on a test page. Which additional feature would make this extension most useful for a comprehensive clickjacking assessment?

   • AThe ability to automatically detect and display the X-Frame-Options and CSP frame-ancestors headers of the target URL.
   • BThe ability to take screenshots of the iframe for documentation purposes.
   • CThe ability to modify the User-Agent string to test with different browser profiles.
   • DThe ability to simulate different screen resolutions to test how the iframe renders on various devices.
   Reveal Solution Discussion Select an answer first