Clickjacking WAHS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which HTML element is most commonly abused in clickjacking attacks?

   • A<iframe>
   • B<script>
   • C<form>
   • D<img>
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When manually inspecting a page for clickjacking, what should you look for in the HTML?

   • AThe presence of <script> tags with inline JavaScript
   • BThe presence of <meta> tags with http-equiv refresh
   • CThe presence of <form> elements with hidden inputs
   • DThe presence of <iframe> elements that load external or sensitive pages
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A social media platform allows users to 'like' posts, follow accounts, and change their profile information. An attacker creates a malicious page that embeds the platform's 'like' button in an invisible iframe and tricks users into clicking a decoy 'Play Video' button. What is the most direct security impact of this attack on the victim user?

   • AThe attacker can perform unintended actions on behalf of the user, such as liking posts or following accounts, without the user's knowledge.
   • BThe attacker can steal the user's session cookie by injecting a script into the iframe.
   • CThe attacker can install malware on the user's device by exploiting a browser vulnerability.
   • DThe attacker can read the user's private messages and profile data displayed on the page.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A QA engineer needs to quickly test a list of internal web applications for clickjacking vulnerabilities. The engineer wants to automate the initial check and then manually verify any findings. Which approach best fits this requirement?

   • AReview the server configuration files for any 'X-Frame-Options' directives
   • BUse a browser extension that automatically detects if a page can be framed and reports missing X-Frame-Options or CSP headers
   • CManually inspect the HTML source of each page for iframe tags
   • DRun a network vulnerability scanner that only checks for SQL injection
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the core mechanism of a clickjacking attack?

   • ATricking users into clicking a different element than they perceive by layering transparent or opaque frames over a visible page
   • BIntercepting and modifying network traffic between the user and the application
   • CRedirecting a user's browser to a malicious website through a specially crafted URL
   • DInjecting malicious scripts into a trusted page to alter its behavior
   Reveal Solution Discussion Select an answer first