GWAPT · Question #137
Which steps help prevent clickjacking attacks? (Choose two)
The correct answer is A. Using the X-Frame-Options header C. Implementing the Content-Security-Policy header. Clickjacking works by embedding your site inside a hidden <iframe> to trick users into clicking malicious UI - both X-Frame-Options (A) and Content-Security-Policy's frame-ancestors directive (C) directly counter this by instructing browsers to refuse framing your pages from…
Question
Which steps help prevent clickjacking attacks? (Choose two)
Options
- AUsing the X-Frame-Options header
- BEnforcing strong password policies
- CImplementing the Content-Security-Policy header
- DDisabling HTTP in favor of HTTPS
How the community answered
(29 responses)- A79% (23)
- B7% (2)
- D14% (4)
Explanation
Clickjacking works by embedding your site inside a hidden <iframe> to trick users into clicking malicious UI - both X-Frame-Options (A) and Content-Security-Policy's frame-ancestors directive (C) directly counter this by instructing browsers to refuse framing your pages from unauthorized origins. Strong password policies (B) protect against credential theft, not UI redress attacks. HTTPS (D) encrypts traffic in transit but does nothing to prevent a page from being framed.
Memory tip: Think "frame blocking = clickjack blocking" - both correct answers control how your page can be framed. If the header doesn't mention frames or ancestors, it won't stop clickjacking.
Community Discussion
No community discussion yet for this question.