Study. uk . com
  1. Home
  2. All questions
  3. Question 294

CISSP study material · question 294 of 500

A site sends a Strict-Transport-Security header carrying only the includeSubDomains directive. Why is the header incomplete?

  1. The max-age directive is required and gives how long the browser treats the site as an HSTS host.
  2. The preload directive is required before subdomains may be included.
  3. The report-uri directive is required so failures can be reported.
  4. The header must also carry the certificate fingerprint to be honoured.
Show the answer

Answer: A. The max-age directive is required and gives how long the browser treats the site as an HSTS host.

RFC 6797 makes max-age a required directive, specifying the number of seconds for which the browser regards the sender as a known HSTS host.

Source: RFC 6797 (IETF) — RFC 6797 > 6.1.1 The max-age Directive

Challenge yourself on this topic → Study as cards