How does HTTP Strict Transport Security (HSTS) protect a web application from protocol downgrade attacks?

By requiring the server to use a certificate from a specific certificate authority.

By encrypting the HTTP response headers so that they cannot be modified by an attacker.

By instructing the browser to only communicate with the server over HTTPS for a specified period.

By blocking all HTTP requests that contain sensitive data in the URL.

A web application serves a dashboard that embeds a partner's analytics widget from https://analytics.partner.com. The app also allows users to upload profile images that are displayed inline. The security team wants to reduce XSS risk while keeping the widget functional. Which CSP directive set is most appropriate?

script-src 'unsafe-inline' https://analytics.partner.com; img-src *; frame-ancestors *

Content-Security-Policy: default-src 'self'; script-src 'self' https://analytics.partner.com; img-src 'self' data:; X-Frame-Options: DENY

default-src 'self'; script-src 'self' https://analytics.partner.com; img-src 'self' data:; frame-ancestors 'self'

default-src 'none'; script-src https://analytics.partner.com; img-src 'self'

What is the role of CORS headers in web applications?

To prevent cross-site scripting attacks by blocking inline scripts.

To enforce HTTPS connections between the browser and server.

To control which origins are allowed to access resources on a server from a web page.

To control which browser features are available to the page.

EC-CouncilWeb Application Hacking and Security

Domain 5Objective 3

HTTP Security Header Directives WAHS Practice Questions (Page 4)

Part of the Cryptographic Failures and Transport Security domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

10concepts

Questions 16–20

16application · medium
A public-facing blog embeds a third-party analytics script. The blog's URLs contain query parameters that include session identifiers. The team wants to prevent these sensitive parameters from being leaked to the analytics provider via the Referer header, while still allowing the analytics provider to see the referring page's origin. Which Referrer-Policy should be set?
Select an answer first
17foundation · easy
How does HTTP Strict Transport Security (HSTS) protect a web application from protocol downgrade attacks?
Select an answer first
18application · medium
A web application serves a dashboard that embeds a partner's analytics widget from https://analytics.partner.com. The app also allows users to upload profile images that are displayed inline. The security team wants to reduce XSS risk while keeping the widget functional. Which CSP directive set is most appropriate?
Select an answer first
19foundation · easy
What is the role of CORS headers in web applications?
Select an answer first
20foundation · easy
Which of the following is a valid value for the X-Content-Type-Options header?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

HTTP Security Header Directives WAHS Practice Questions (Page 4)

Questions 16–20

How does HTTP Strict Transport Security (HSTS) protect a web application from protocol downgrade attacks?

What is the role of CORS headers in web applications?

Which of the following is a valid value for the X-Content-Type-Options header?

Keep studying — Cryptographic Failures and Transport Security