Exam PT0-003 Topic 4 Question 264 Discussion

Actual exam question for CompTIA's PT0-003 exam
Question #: 264
Topic #: 4
A penetration tester finds it is possible to downgrade a web application's HTTPS connections to HTTP while performing on-path attacks on the local network. The tester reviews the output of the server response to:
HTTP/2 302
date: Thu, 11 Jan 2024 15:56:24 GMT
content-type: text/html; charset=iso-8859-l
location: /login
x-content-type-options: nosniff
server: Prod
Which of the following recommendations should the penetration tester include in the report?

Suggested Answer: A Vote an answer

The tester identified an HTTPS downgrade attack (e.g., SSL stripping). The best mitigation is to enforce HSTS (HTTP Strict Transport Security).
HSTS (Strict-Transport-Security) ensures that the browser always uses HTTPS, preventing downgrade attacks.

by Griffith at Aug 28, 2026, 02:59 AM

Limited Time Offer

15%

Off

Get Premium PT0-003 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10