CEH Web Application and Injection Attacks Practice Question
Which of the following is a common defense against clickjacking attacks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Content Security Policy (CSP) with 'frame-ancestors' directive
Clickjacking attacks trick users into clicking on a hidden or disguised element on a page that is embedded in a malicious frame. The Content Security Policy (CSP) directive 'frame-ancestors' is a modern and effective defense against clickjacking. It allows the server to specify which origins are permitted to embed the page in frames, providing granular control. For example, 'frame-ancestors none' blocks all embedding, while 'frame-ancestors self' allows same-origin framing only. This directive supersedes the older X-Frame-Options header, which only supports DENY or SAMEORIGIN and is less flexible. Therefore, CSP with 'frame-ancestors' is the correct choice among the given options.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CSRF tokens
Why it's wrong here
CSRF tokens are unique, unpredictable values embedded in web forms or URLs to verify that a request originated from the legitimate user's browser, not a forged cross-site request. While highly effective against Cross-Site Request Forgery (CSRF) by ensuring request authenticity, they do not prevent clickjacking. Clickjacking exploits the visual rendering of a legitimate page within a malicious iframe, tricking the user into *voluntarily* clicking an element, a scenario where CSRF tokens offer no protection against the initial UI manipulation.
- ✓
Content Security Policy (CSP) with 'frame-ancestors' directive
Why this is correct
The `Content-Security-Policy` (CSP) header with the `frame-ancestors` directive explicitly defines which origins are permitted to embed the current resource in a frame, iframe, object, or embed tag. By restricting framing to 'self' or specific trusted domains (e.g., `frame-ancestors 'self'`), this policy directly prevents malicious external websites from embedding the target page. This robust defense effectively mitigates clickjacking attacks by controlling the contexts in which a page can be framed, thereby preventing UI redressing.
- ✗
SameSite cookies
Why it's wrong here
SameSite cookies enhance security by instructing browsers to restrict when cookies are sent with cross-site requests, primarily to prevent CSRF attacks. By default, they limit the transmission of cookies to third-party contexts, making it harder for attackers to leverage authenticated sessions for forged requests. However, this mechanism does not prevent a malicious site from framing a legitimate page and overlaying it with deceptive elements, as the user's interaction with the framed content still occurs within the legitimate site's context, even if cookies aren't sent cross-site for initial loading.
- ✗
Input validation
Why it's wrong here
Input validation is a security measure focused on ensuring that user-supplied data conforms to expected formats, types, and ranges, preventing injection attacks like SQLi or XSS. It operates by sanitizing or rejecting malicious input before it can be processed by the application. Clickjacking, however, is a client-side UI redressing attack that manipulates user interaction with a legitimate page's visual elements, entirely independent of the data being submitted or processed by server-side input validation routines.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.