A penetration tester is manually checking a web application for clickjacking. The tester loads the target page in an iframe on a local test page and notices that the iframe content is visible and interactive. Which additional step should the tester perform to confirm the vulnerability?

Check if the target page uses HTTPS and has a valid SSL certificate

Verify that the target page does not use any JavaScript alerts or pop-ups

Inspect the response headers of the target page for X-Frame-Options or CSP frame-ancestors

Confirm that the target page is not using any third-party cookies

A user reports that after clicking a 'Download Now' button on a movie streaming site, they were redirected to a banking site and a transfer was initiated. The user did not authorize the transfer. Which attack vector best describes this scenario?

The movie site redirected the user to a fake phishing page that mimicked the banking site and captured the transfer details.

The movie site used a cross-site scripting (XSS) vulnerability in the banking site to inject a malicious script that initiated the transfer.

The movie site exploited a browser vulnerability to automatically submit the transfer form without user interaction.

The movie site loaded the banking site in a transparent iframe over the 'Download Now' button, so the click was captured by the banking site's 'Confirm Transfer' button.

A social media platform allows users to post content that includes HTML. An attacker crafts a post with a transparent iframe overlay that loads the 'Delete Account' page of the platform. When users click anywhere on the post, they unintentionally click the 'Confirm Deletion' button. What is the most direct impact of this attack on the victim?

The victim's browser is infected with malware from the malicious post

The victim's account is deleted without their knowledge

The victim's session token is stolen and used for identity theft

The victim's private messages are exposed to the attacker

A security analyst is assessing the impact of a clickjacking vulnerability on a banking application. The application allows users to transfer funds. The analyst needs to determine the maximum potential impact. Which factor most increases the severity of the vulnerability?

The application uses session cookies without the Secure flag

The application has no CSRF tokens on the transfer form

The transfer function is a single-click action with no confirmation step

The application is accessible over the public internet

A security team wants to integrate clickjacking testing into their CI/CD pipeline. They need a tool that can be run from the command line and produce a report of which pages are missing framing protections. Which tool is most appropriate for this task?

A command-line HTTP scanner that checks response headers for X-Frame-Options and CSP frame-ancestors

A browser extension that manually tests pages in a GUI

A source code scanner that looks for iframe tags in HTML

A network packet analyzer that captures traffic

EC-CouncilWeb Application Hacking and Security

Domain 6Objective 3

Clickjacking WAHS Practice Questions (Page 3)

Part of the Security Misconfiguration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~19–31 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 11–15

11application · medium
A penetration tester is manually checking a web application for clickjacking. The tester loads the target page in an iframe on a local test page and notices that the iframe content is visible and interactive. Which additional step should the tester perform to confirm the vulnerability?
Select an answer first
12application · medium
A user reports that after clicking a 'Download Now' button on a movie streaming site, they were redirected to a banking site and a transfer was initiated. The user did not authorize the transfer. Which attack vector best describes this scenario?
Select an answer first
13application · medium
A social media platform allows users to post content that includes HTML. An attacker crafts a post with a transparent iframe overlay that loads the 'Delete Account' page of the platform. When users click anywhere on the post, they unintentionally click the 'Confirm Deletion' button. What is the most direct impact of this attack on the victim?
Select an answer first
14expert · medium
A security analyst is assessing the impact of a clickjacking vulnerability on a banking application. The application allows users to transfer funds. The analyst needs to determine the maximum potential impact. Which factor most increases the severity of the vulnerability?
Select an answer first
15application · medium
A security team wants to integrate clickjacking testing into their CI/CD pipeline. They need a tool that can be run from the command line and produce a report of which pages are missing framing protections. Which tool is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.