200-901 Application Deployment and Security Practice Question
A developer needs to enforce HTTPS for a web application. Which security measure should be implemented in the application or reverse proxy?
⚠ Common exam trap
Cisco often tests the distinction between security measures that protect data in transit (HTTPS/SSL termination) versus those that protect data at rest or during processing (input validation, parameterized queries), leading candidates to confuse application-layer defenses with transport-layer encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL/TLS termination and HTTP redirect
Enforcing HTTPS requires the reverse proxy or application to terminate incoming SSL/TLS connections (decrypting traffic at the proxy) and then redirect any HTTP requests to HTTPS using a 301 or 302 redirect. This ensures all client traffic is encrypted in transit, meeting security best practices and compliance requirements like PCI DSS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSL/TLS termination and HTTP redirect
Why this is correct
Terminating SSL/TLS at the reverse proxy decrypts incoming traffic there, then a redirect rule rewrites any HTTP request to HTTPS, so every client connection is forced onto TLS. This directly satisfies the requirement to enforce HTTPS across the web application.
- ✗
Parameterized queries
Why it's wrong here
Parameterized queries bind user input as data rather than executable SQL, preventing injection attacks; they do nothing to enforce TLS or redirect HTTP traffic. They are the right choice when untrusted input reaches a database query, not when the requirement is transport encryption between client and reverse proxy.
- ✗
CORS configuration
Why it's wrong here
CORS governs which browser origins may read responses from a different origin; it does not encrypt traffic or redirect HTTP to HTTPS. Enforcing HTTPS requires HSTS headers or redirect rules at the reverse proxy, which is why CORS is tempting whenever browser-facing security headers are discussed.
- ✗
Input validation
Why it's wrong here
Input validation rejects malformed or malicious data at entry points, addressing injection and data-integrity risks, but it cannot negotiate TLS or redirect HTTP requests to HTTPS. It would be correct when sanitising user-supplied fields before processing, not when enforcing encrypted transport.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.