Study. uk . com
  1. Home
  2. All questions
  3. Question 299

CISSP study material · question 299 of 500

A site emits its Strict-Transport-Security header on both its HTTP and HTTPS responses so that first-time visitors pick up the policy sooner. What does RFC 6797 say?

  1. The header over HTTP is permitted where max-age is under one day.
  2. The header must appear on both so that browsers can compare the values.
  3. The header is honoured over HTTP only for the first visit.
  4. A host must not include the header in responses carried over non-secure transport.
Show the answer

Answer: D. A host must not include the header in responses carried over non-secure transport.

RFC 6797 states an HSTS host must not include the header field in HTTP responses conveyed over non-secure transport; the policy may only be established over secure transport.

Source: RFC 6797 (IETF) — RFC 6797 > 7.2 HTTP Request Type

Challenge yourself on this topic → Study as cards