A web application has pages that contain sensitive query-string parameters (e.g., session tokens). The team wants to ensure that when users navigate to external sites, the full URL is NOT sent in the Referer header, but the origin (scheme, host, port) may be sent to internal subdomains. Which Referrer-Policy value should be set?

strict-origin-when-cross-origin

What is the purpose of the X-Content-Type-Options header?

To specify the allowed MIME types for resources loaded by the page.

To compress the response body to reduce bandwidth usage.

To set the character encoding for the response body.

To prevent the browser from MIME type sniffing and force it to use the declared Content-Type.

A development team is configuring security headers for a new application. They want to implement a defense-in-depth approach against XSS and MIME sniffing. Which combination of headers should they apply globally to all responses?

Referrer-Policy: no-referrer; Permissions-Policy: geolocation=()

X-Frame-Options: DENY; Cache-Control: no-store

Strict-Transport-Security: max-age=31536000; X-Content-Type-Options: nosniff

Content-Security-Policy: default-src 'self'; X-Content-Type-Options: nosniff

A security engineer is hardening a legacy web application that has many inline event handlers (e.g., onclick) and uses a third-party CDN for jQuery. The team wants to implement CSP to reduce XSS risk, but they cannot refactor the inline handlers immediately. Which CSP strategy best balances security and functionality?

Set CSP with 'unsafe-inline' for script-src and a strict default-src, and plan to refactor inline handlers later.

Set CSP with script-src 'self' https://cdn.example.com and no 'unsafe-inline', breaking all inline handlers until refactoring is complete.

Set CSP in report-only mode first to identify violations, then gradually tighten the policy while refactoring inline handlers.

Set CSP with script-src 'self' https://cdn.example.com 'unsafe-inline' and use a nonce for inline scripts, but keep the inline handlers as they are.

A security team is implementing CSP for a large legacy application that heavily uses inline event handlers (e.g., onclick attributes) and inline styles. They want to reduce XSS risk but cannot refactor the code immediately. Which CSP strategy is the most appropriate for a gradual migration?

Immediately enforce a strict policy with default-src 'self' and no unsafe-inline

Start with a restrictive policy in report-only mode, collect violation reports, and gradually refactor code to eliminate unsafe-inline

Set Content-Security-Policy-Report-Only with a permissive policy that allows all sources

Use a policy with 'unsafe-inline' for scripts and styles permanently

EC-CouncilWeb Application Hacking and Security

Domain 5Objective 3

HTTP Security Header Directives WAHS Practice Questions (Page 2)

Part of the Cryptographic Failures and Transport Security domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

10concepts

Questions 6–10

6application · medium
A web application has pages that contain sensitive query-string parameters (e.g., session tokens). The team wants to ensure that when users navigate to external sites, the full URL is NOT sent in the Referer header, but the origin (scheme, host, port) may be sent to internal subdomains. Which Referrer-Policy value should be set?
Select an answer first
7foundation · easy
What is the purpose of the X-Content-Type-Options header?
Select an answer first
8application · easy
A development team is configuring security headers for a new application. They want to implement a defense-in-depth approach against XSS and MIME sniffing. Which combination of headers should they apply globally to all responses?
Select an answer first
9expert · hard
A security engineer is hardening a legacy web application that has many inline event handlers (e.g., onclick) and uses a third-party CDN for jQuery. The team wants to implement CSP to reduce XSS risk, but they cannot refactor the inline handlers immediately. Which CSP strategy best balances security and functionality?
Select an answer first
10expert · hard
A security team is implementing CSP for a large legacy application that heavily uses inline event handlers (e.g., onclick attributes) and inline styles. They want to reduce XSS risk but cannot refactor the code immediately. Which CSP strategy is the most appropriate for a gradual migration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

HTTP Security Header Directives WAHS Practice Questions (Page 2)

Questions 6–10

What is the purpose of the X-Content-Type-Options header?

A development team is configuring security headers for a new application. They want to implement a defense-in-depth approach against XSS and MIME sniffing. Which combination of headers should they apply globally to all responses?

A security team is implementing CSP for a large legacy application that heavily uses inline event handlers (e.g., onclick attributes) and inline styles. They want to reduce XSS risk but cannot refactor the code immediately. Which CSP strategy is the most appropriate for a gradual migration?

Keep studying — Cryptographic Failures and Transport Security