Study. uk . com
  1. Home
  2. All questions
  3. Question 298

CISSP study material · question 298 of 500

A user visits a known HSTS host whose certificate has just expired and wants to proceed anyway. What does RFC 6797 require of the browser?

  1. It must terminate the connection on any secure transport error or warning, leaving the user no way through.
  2. It must proceed if the user has visited the site before.
  3. It must fall back to plain HTTP and display a warning banner.
  4. It must present a warning and allow the user to accept the risk.
Show the answer

Answer: A. It must terminate the connection on any secure transport error or warning, leaving the user no way through.

Under HSTS the user agent terminates any secure transport connection attempt upon any and all secure transport errors or warnings, which removes the click-through option.

Source: RFC 6797 (IETF) — RFC 6797 > 2.2 HTTP Strict Transport Security Policy Effects

Challenge yourself on this topic → Study as cards