4.8 Evaluate the Parts of an HTTP Response (response Code, Headers, Body) 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An analyst is investigating a potential HTTP response splitting attack. The analyst notices that a response includes a header that contains a CRLF (%0d%0a) sequence. What is the most likely security concern?

   • AThe server is vulnerable to a denial-of-service attack.
   • BThe response is missing the Content-Length header.
   • CAn attacker may be able to inject additional headers or body content into the response.
   • DThe response body is malformed and will not render correctly.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is investigating a suspicious HTTP response. The response includes a status line with code 302, a Location header, and a Set-Cookie header. The analyst needs to determine the server's intent. What is the most accurate interpretation?

   • AThe server is rejecting the request due to authentication failure.
   • BThe server is reporting a client error and providing a new resource location.
   • CThe server is indicating that the requested resource has permanently moved.
   • DThe server is redirecting the client to another URL and establishing a session.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is investigating a potential session fixation attack. The analyst observes that the server's response includes a Set-Cookie header. What is the primary purpose of this header?

   • ATo specify the content type of the response body.
   • BTo indicate that the response should not be cached.
   • CTo instruct the client to store a cookie that will be sent with subsequent requests.
   • DTo provide the length of the response body in bytes.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A server response includes the header 'Set-Cookie: sessionId=abc123; Path=/'. What is the purpose of this header?

   • AIt tells the client how long the response can be cached.
   • BIt specifies the size of the response body in bytes.
   • CIt indicates the media type of the response body.
   • DIt instructs the client to store a cookie that will be sent back with subsequent requests.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   An analyst is reviewing a web application's response to a request for a user profile page. The response includes the header 'Content-Security-Policy: default-src 'self''. What is the security purpose of this header?

   • ATo specify the character encoding of the response body.
   • BTo indicate that the response body is compressed.
   • CTo prevent the response from being cached.
   • DTo restrict the sources from which the browser can load resources.
   Reveal Solution Discussion Select an answer first