Crucial Exams

Certified Ethical Hacker (CEH) Practice Question

While testing a single-page web application, you intercept a GET request that returns:

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 48

{"msg":"Hello, <script>alert(1)</script>"}

The server never sets the X-Content-Type-Options response header. Modern browsers therefore fall back on MIME sniffing when the response begins with an HTML DOCTYPE that you can inject. What client-side attack does this misconfiguration allow you to perform against other users most directly?

  • Force the site to render inside a hidden iframe to steal clicks (clickjacking).

  • Trigger reflected cross-site scripting and run arbitrary JavaScript in the victim's browser.

  • Execute SQL statements directly on the back-end database from the client.

  • Bypass anti-CSRF tokens and submit forged POST requests silently.

Certified Ethical Hacker (CEH)
Web Application Hacking
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot