Study. uk . com
  1. Home
  2. All questions
  3. Question 295

CISSP study material · question 295 of 500

A site needs to stop browsers enforcing its HSTS policy, having moved a service to a subdomain that cannot yet serve HTTPS. What effect does sending max-age of zero have?

  1. The browser retains the policy until the previously advertised period expires.
  2. The browser stops treating the host as an HSTS host, and the subdomain assertion is cleared with it.
  3. The browser keeps the policy but stops applying it to subdomains only.
  4. The browser rejects the header as malformed and keeps the existing policy.
Show the answer

Answer: B. The browser stops treating the host as an HSTS host, and the subdomain assertion is cleared with it.

Zero tells the browser to stop counting the site among its known HSTS hosts, and any subdomain assertion falls away at the same time.

Source: RFC 6797 (IETF) — RFC 6797 > 6.1.1 The max-age Directive

Challenge yourself on this topic → Study as cards