A web application is currently using X-Frame-Options: SAMEORIGIN to prevent clickjacking. The team wants to allow framing only from a specific partner origin, not the entire same origin. Which change should they make?

Keep X-Frame-Options: SAMEORIGIN and add a meta tag for the partner

Change X-Frame-Options to ALLOW-FROM https://partner.example.com

Replace X-Frame-Options with Content-Security-Policy: frame-ancestors https://partner.example.com

Add Content-Security-Policy: frame-src https://partner.example.com

An application uses a third-party analytics script loaded from https://analytics.example.com/script.js. The team wants a CSP that allows this script while blocking all other external scripts. Which directive should be used?

default-src https://analytics.example.com

script-src https://analytics.example.com

script-src 'self' https://analytics.example.com

What does the Referrer-Policy header control?

Whether the browser should send cookies with cross-origin requests.

Whether the browser should allow the page to be embedded in iframes.

Whether the browser should cache the response for later use.

How much information about the referring page is sent in the Referer header when navigating to another origin.

EC-CouncilWeb Application Hacking and Security

Domain 5Objective 3

HTTP Security Header Directives WAHS Practice Questions (Page 5)

Part of the Cryptographic Failures and Transport Security domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

10concepts

Questions 21–25

21foundation · easy
Which Cache-Control directive prevents a browser from storing a response in any cache?
Select an answer first
22application · medium
A web application is currently using X-Frame-Options: SAMEORIGIN to prevent clickjacking. The team wants to allow framing only from a specific partner origin, not the entire same origin. Which change should they make?
Select an answer first
23application · easy
An application uses a third-party analytics script loaded from https://analytics.example.com/script.js. The team wants a CSP that allows this script while blocking all other external scripts. Which directive should be used?
Select an answer first
24foundation · easy
What does the Referrer-Policy header control?
Select an answer first
25foundation · easy
Which of the following is an example of a browser feature that can be controlled using the Permissions-Policy header?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

HTTP Security Header Directives WAHS Practice Questions (Page 5)

Questions 21–25

Which Cache-Control directive prevents a browser from storing a response in any cache?

A web application is currently using X-Frame-Options: SAMEORIGIN to prevent clickjacking. The team wants to allow framing only from a specific partner origin, not the entire same origin. Which change should they make?

An application uses a third-party analytics script loaded from https://analytics.example.com/script.js. The team wants a CSP that allows this script while blocking all other external scripts. Which directive should be used?

What does the Referrer-Policy header control?

Which of the following is an example of a browser feature that can be controlled using the Permissions-Policy header?

Keep studying — Cryptographic Failures and Transport Security