Which of the following is a common clickjacking attack vector?

Exploiting a SQL injection flaw to modify the application's HTML output

Using a transparent iframe to overlay a malicious button on top of a legitimate page

Sending a crafted email with a link to a malicious website that steals cookies

Performing a denial-of-service attack to make the application unavailable

Which browser extension is specifically designed to help test for clickjacking by allowing you to view a page as it would appear inside an iframe?

Clickjacking Test (or similar iframe testing extensions)

Which of the following is a realistic consequence of clickjacking?

The user is tricked into clicking a 'Confirm' button that actually triggers a payment transaction

The user's browser is redirected to a phishing site that mimics the original application

The attacker gains administrative access to the application's backend

The attacker steals the user's session cookie by injecting JavaScript into the target page

A security researcher is analyzing a clickjacking attack that uses a transparent iframe. The attacker's page has an iframe that loads the target application, and the iframe is made transparent using CSS. Which additional technique can the attacker use to increase the precision of the clickjacking attack?

Use a pop-up window to cover the target button

Use CSS to position the iframe so that the target button is exactly under the visible button

Use a browser extension to modify the target page's DOM

Use JavaScript to automatically submit the form on page load

A developer is fixing a clickjacking vulnerability in a web application that must be embeddable in a partner's dashboard via iframe. The partner's domain is 'dashboard.partner.com'. Which configuration allows the application to be framed only by that specific partner?

Set X-Frame-Options: SAMEORIGIN

Use a frame-busting script that checks the top-level domain and allows only dashboard.partner.com

Set Content-Security-Policy: frame-ancestors https://dashboard.partner.com

Set X-Frame-Options: ALLOW-FROM https://dashboard.partner.com

EC-CouncilWeb Application Hacking and Security

Domain 6Objective 3

Clickjacking WAHS Practice Questions (Page 4)

Part of the Security Misconfiguration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~19–31 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 16–20

16foundation · easy
Which of the following is a common clickjacking attack vector?
Select an answer first
17foundation · easy
Which browser extension is specifically designed to help test for clickjacking by allowing you to view a page as it would appear inside an iframe?
Select an answer first
18foundation · easy
Which of the following is a realistic consequence of clickjacking?
Select an answer first
19expert · medium
A security researcher is analyzing a clickjacking attack that uses a transparent iframe. The attacker's page has an iframe that loads the target application, and the iframe is made transparent using CSS. Which additional technique can the attacker use to increase the precision of the clickjacking attack?
Select an answer first
20application · medium
A developer is fixing a clickjacking vulnerability in a web application that must be embeddable in a partner's dashboard via iframe. The partner's domain is 'dashboard.partner.com'. Which configuration allows the application to be framed only by that specific partner?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.