What is a common misconfiguration to avoid when setting the Content-Security-Policy header?

Setting the header on all responses, including API responses.

Using the 'frame-ancestors' directive to restrict framing.

Setting the header to 'default-src 'self''.

Using 'unsafe-inline' for script-src, which allows inline scripts and weakens XSS protection.

Which statement best describes the primary purpose of HTTP security headers in a web application?

To instruct the browser to enforce security policies that reduce the risk of client-side attacks.

To authenticate users and authorize access to protected resources.

To replace the need for server-side input validation and output encoding.

To encrypt the HTTP response body so that sensitive data cannot be read by intermediaries.

Which Referrer-Policy value ensures that no Referer header is sent with requests?

strict-origin-when-cross-origin

EC-CouncilWeb Application Hacking and Security

Domain 5Objective 3

HTTP Security Header Directives WAHS Practice Questions (Page 6)

Part of the Cryptographic Failures and Transport Security domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

10concepts

Questions 26–30

26foundation · easy
What is a common misconfiguration to avoid when setting the Content-Security-Policy header?
Select an answer first
27foundation · easy
Which of the following is a category of HTTP security headers used to control browser features and resource loading?
Select an answer first
28foundation · easy
Which statement best describes the primary purpose of HTTP security headers in a web application?
Select an answer first
29foundation · easy
Which CSP directive provides a more flexible alternative to X-Frame-Options for controlling frame embedding?
Select an answer first
30foundation · easy
Which Referrer-Policy value ensures that no Referer header is sent with requests?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

HTTP Security Header Directives WAHS Practice Questions (Page 6)

Questions 26–30

What is a common misconfiguration to avoid when setting the Content-Security-Policy header?

Which of the following is a category of HTTP security headers used to control browser features and resource loading?

Which statement best describes the primary purpose of HTTP security headers in a web application?

Which CSP directive provides a more flexible alternative to X-Frame-Options for controlling frame embedding?

Which Referrer-Policy value ensures that no Referer header is sent with requests?

Keep studying — Cryptographic Failures and Transport Security