An organization had a recent breach with a man-in-the-middle attack. Attackers were able to intercept traffic and steal customer's data. The organization has asked a security engineer to make its…

Question

Options

• AConfigure the HTTP Strict Transport Security.
• BImplement session timeouts.
• CImplement HTTP authentication.
• DConfigure a secure cookie attribute.

• A
  76% (45)
• B
  5% (3)
• C
  3% (2)
• D
  15% (9)

Explanation

HSTS (HTTP Strict Transport Security) is the correct answer because it instructs browsers to only communicate with a server over HTTPS, eliminating the ability for attackers to downgrade connections to unencrypted HTTP - the primary vector exploited in MITM attacks. By enforcing encrypted transport at the protocol level, intercepted traffic is useless to attackers since it cannot be read in plaintext.

Why the distractors are wrong:

• B (Session timeouts) reduces the damage window of a stolen session but does nothing to prevent the interception itself.
• C (HTTP authentication) transmits credentials over an unencrypted channel, which would actually worsen exposure to MITM attacks.
• D (Secure cookie attribute) protects cookies from being sent over HTTP, but it's narrowly scoped to cookies only - HSTS enforces encrypted transport for all traffic across the entire domain.

Memory tip: Think of HSTS as a "HTTPS-only bouncer" - once configured, the browser refuses to enter over HTTP, no matter what an attacker says. The key distinction on the exam is scope: HSTS = whole connection; Secure cookie = just the cookie jar.

No community discussion yet for this question.