350-201(NEW-127Q) · Question #103
Refer to the exhibit. Where are the browser page rendering permissions displayed?
The correct answer is B. X-Frame-Options. X-Frame-Options is the HTTP response header specifically designed to control whether a browser is permitted to render a page inside a <frame>, <iframe>, <embed>, or <object> element. It enforces rendering permissions with values like DENY (never render in a frame), SAMEORIGIN…
Question
Options
- AContent-Type
- BX-Frame-Options
- CX-XSS-Protection
- DCache-Control
How the community answered
(26 responses)- B92% (24)
- C4% (1)
- D4% (1)
Explanation
X-Frame-Options is the HTTP response header specifically designed to control whether a browser is permitted to render a page inside a <frame>, <iframe>, <embed>, or <object> element. It enforces rendering permissions with values like DENY (never render in a frame), SAMEORIGIN (only same-origin frames), or ALLOW-FROM (a specified origin), making it a key defense against clickjacking attacks.
Why the distractors are wrong:
- A. Content-Type - tells the browser how to interpret the content (e.g.,
text/html,application/json), not whether it can render in a frame. - C. X-XSS-Protection - enables the browser's built-in Cross-Site Scripting filter; it's about script injection defense, not rendering permissions.
- D. Cache-Control - governs how long and where a response is cached; it has nothing to do with frame rendering.
Memory tip: Think of X-Frame-Options as the "frame bouncer" - it stands at the door of your page and decides who is allowed to embed it inside their frame. If you see "frame" or "rendering in a frame," think X-Frame-Options.
Topics
Community Discussion
No community discussion yet for this question.