CAS-004 Security Engineering Practice Question
A security administrator is hardening a web server and wants to ensure that browsers cannot be tricked into sending requests over plain HTTP after an initial HTTPS visit. The administrator also wants to prevent protocol-downgrade attacks against the site. Which response header should be configured?
⚠ Common exam trap
The trap here is assuming any modern security header, such as a content security policy, also enforces HTTPS transport.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Strict-Transport-Security tells the browser to rewrite future requests for the domain to HTTPS and to refuse insecure connections for the max-age window, which blocks downgrade attacks. The other headers address resource loading, framing, and referrer leakage respectively, none of which enforce transport security or prevent a fallback to HTTP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Why this is correct
The Strict-Transport-Security header instructs browsers to upgrade all future requests for the domain to HTTPS for the specified max-age, and includeSubDomains extends this to subdomains while preload allows inclusion in browser preload lists. This directly prevents protocol downgrade and plaintext requests after the first secure visit.
- ✗
Content-Security-Policy: default-src 'self'
Why it's wrong here
Content-Security-Policy restricts which sources scripts, styles, and other resources may load from, mitigating cross-site scripting and injection. It does not force the browser to use HTTPS for subsequent navigations, so it cannot prevent a downgrade to plain HTTP or stop the user from requesting the HTTP URL.
- ✗
X-Frame-Options: DENY
Why it's wrong here
X-Frame-Options controls whether the page may be embedded in a frame, defending against clickjacking. It has no bearing on transport security or protocol downgrade, so configuring it leaves the site vulnerable to being accessed over plain HTTP after an initial secure visit.
- ✗
Referrer-Policy: no-referrer
Why it's wrong here
Referrer-Policy governs how much referrer information is sent with outbound requests, protecting privacy and limiting leakage of URLs to third parties. It does not enforce HTTPS or prevent downgrade attacks, so it does not satisfy the requirement to keep browsers on the secure scheme.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.