HTTP Security Header Directives WAHS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security engineer is reviewing the response headers of a production web application. They see the following headers: 'Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com' and 'Strict-Transport-Security: max-age=31536000'. The application also uses inline scripts for critical functionality. What is the most likely issue?

   • AThe HSTS max-age is too long and should be reduced.
   • BThe HSTS header is missing includeSubDomains, so subdomains are not protected.
   • CThe CSP will block all inline scripts, breaking the application's functionality.
   • DThe CSP allows scripts from the CDN, which could be compromised.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of the Permissions-Policy header?

   • ATo control how the browser caches responses from the server.
   • BTo define which origins are allowed to load scripts and styles on the page.
   • CTo specify which HTTP methods are allowed for cross-origin requests.
   • DTo allow or deny the use of browser features such as camera, microphone, and geolocation for the page and its iframes.
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A file-sharing site allows users to upload documents and then serves them with a Content-Type header based on the file extension. A security auditor warns that browsers might interpret an uploaded HTML file as a different MIME type, leading to stored XSS. Which header should the site add to its responses to prevent this?

   • AX-Frame-Options: DENY
   • BX-Content-Type-Options: nosniff
   • CCache-Control: no-store
   • DContent-Security-Policy: default-src 'none'
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a best practice when implementing HTTP security headers?

   • ASet security headers on all responses, including error pages and static assets.
   • BSet a permissive CSP (e.g., 'default-src *') to ensure all third-party scripts load correctly.
   • COnly set security headers on pages that handle sensitive data.
   • DUse only one security header to avoid conflicts between them.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A developer is configuring CORS for an API that supports both a web frontend at https://app.example.com and a mobile app. The mobile app does not send an Origin header. The API currently returns 'Access-Control-Allow-Origin: *'. The team wants to allow the web frontend to send credentials (cookies) but does not want to break the mobile app. What is the best approach?

   • ASet Access-Control-Allow-Origin: null to allow both the web frontend and mobile app.
   • BKeep Access-Control-Allow-Origin: * and add Access-Control-Allow-Credentials: true.
   • CSet Access-Control-Allow-Origin: https://app.example.com and do not set Access-Control-Allow-Credentials.
   • DChange the API to echo the Origin header and set Access-Control-Allow-Credentials: true, and keep the mobile app working because it does not send an Origin header.
   Reveal Solution Discussion Select an answer first