CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable HTTP Strict-Transport-Security (HSTS)

  Why it's wrong here

  HTTP Strict-Transport-Security (HSTS) is a security mechanism designed to protect websites against protocol downgrade attacks and cookie hijacking by forcing user agents to interact with the server exclusively over HTTPS. While essential for ensuring encrypted communication and overall web security, HSTS does not prevent a malicious site from embedding the target page within an iframe. Therefore, it offers no direct mitigation against the visual manipulation inherent in a clickjacking attack.

• ✓

  Set Content-Security-Policy: frame-ancestors 'none'

  Why this is correct

  The `Content-Security-Policy: frame-ancestors 'none'` directive is a modern and highly effective mitigation against clickjacking. This policy explicitly instructs the browser that the resource cannot be embedded within any frame, iframe, object, embed, or applet by any domain, including its own. By preventing the target page from being loaded in a hidden or overlaid frame, it directly thwarts attempts to trick users into performing unintended actions.

• ✗

  Use CSRF tokens

  Why it's wrong here

  CSRF tokens are a security measure primarily used to protect against Cross-Site Request Forgery (CSRF) attacks by ensuring that state-changing requests originate from the legitimate web application. These tokens are typically unique, unpredictable values embedded in forms and validated on the server to confirm user intent. However, clickjacking exploits user interaction with a legitimate, framed user interface, not the absence of a token, rendering CSRF tokens ineffective against this specific type of attack.

• ✓

  Set X-Frame-Options: DENY

  Why this is correct

  The `X-Frame-Options: DENY` HTTP response header is a widely supported and effective mitigation against clickjacking. When a browser encounters this header, it is explicitly instructed to prevent the page from being rendered within any frame, iframe, or object, regardless of the embedding site's origin. This directly thwarts clickjacking attempts by ensuring the target page cannot be visually manipulated or hidden behind a malicious overlay.

• ✗

  Set SameSite cookies to Strict

  Why it's wrong here

  Setting SameSite cookies to `Strict` is a robust defense against Cross-Site Request Forgery (CSRF) by preventing the browser from sending cookies with cross-site requests, except when navigating to the target site via a top-level GET request. While this significantly enhances cookie security and mitigates CSRF by limiting cookie transmission, it does not prevent a malicious website from embedding a legitimate page in an iframe and overlaying it to trick a user into clicking, which is the core mechanism of a clickjacking attack.

Go deeper

Related to this question