200-201 Question 295
Select 3During an investigation, a cybersecurity analyst observes that a user is accessing a sensitive internal web application using HTTP instead of HTTPS. The analyst also identifies that the application supports HTTP/2. What should the analyst recommend to enhance the application's security and align with best practices?
- A
Disable HTTP and enforce HTTPS for all connections.
- B
Implement HSTS (HTTP Strict Transport Security) to prevent protocol downgrade attacks.
- C
Disable HTTP/2 and enforce HTTP/1.1 to ensure better compatibility with security tools.
- D
Use a valid SSL/TLS certificate for the application.
- E
Allow HTTP connections but redirect them to HTTPS for convenience.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enhance security for a web application, it is critical to enforce HTTPS, implement HSTS to prevent downgrade attacks, and use a valid SSL/TLS certificate to secure communication. HTTP/2 should be retained as it provides performance advantages without compromising security when used over HTTPS. Allowing HTTP connections, even with redirection to HTTPS, introduces unnecessary risks.
- A. Correct.
Disabling HTTP and enforcing HTTPS ensures secure encrypted communication and eliminates the risk of transmitting sensitive data over an unencrypted channel.
- B. Correct.
HSTS (HTTP Strict Transport Security) helps prevent protocol downgrade attacks and ensures all connections are made via HTTPS, enhancing security.
- C. Incorrect.
Disabling HTTP/2 is not recommended as it offers performance benefits and is designed to work securely with SSL/TLS. Security tools can be updated to support HTTP/2.
- D. Correct.
Using a valid SSL/TLS certificate is critical for establishing trust and ensuring secure communication between the client and the server.
- E. Incorrect.
Allowing HTTP connections and redirecting them to HTTPS still leaves the initial connection vulnerable to interception or downgrade attacks.