nerdexam
GIAC

GWAPT · Question #99

Which HTTP header is MOST effective at mitigating clickjacking attacks?

The correct answer is B. X-Frame-Options. X-Frame-Options directly prevents clickjacking by telling the browser whether a page is allowed to be rendered inside a <frame>, <iframe>, or <object>. Setting it to DENY or SAMEORIGIN blocks attackers from embedding your page invisibly over their own malicious UI to trick…

Question

Which HTTP header is MOST effective at mitigating clickjacking attacks?

Options

  • AContent-Type
  • BX-Frame-Options
  • CStrict-Transport-Security
  • DSet-Cookie

How the community answered

(44 responses)
  • A
    16% (7)
  • B
    73% (32)
  • C
    7% (3)
  • D
    5% (2)

Explanation

X-Frame-Options directly prevents clickjacking by telling the browser whether a page is allowed to be rendered inside a <frame>, <iframe>, or <object>. Setting it to DENY or SAMEORIGIN blocks attackers from embedding your page invisibly over their own malicious UI to trick users into clicking.

  • A (Content-Type) controls how the browser interprets response data (e.g., text/html). It's unrelated to framing behavior.
  • C (Strict-Transport-Security / HSTS) forces HTTPS connections, defending against protocol downgrade attacks - not framing.
  • D (Set-Cookie) governs cookie transmission rules (e.g., HttpOnly, Secure). It can limit session theft but does nothing to prevent page embedding.

Memory tip: Think "X-Frame = X out the frame" - the header literally crosses out the ability to frame your page, which is the exact mechanism clickjacking exploits.

Community Discussion

No community discussion yet for this question.

Full GWAPT Practice