Study. uk . com
  1. Home
  2. All questions
  3. Question 396

CompTIA Security+ study material · question 396 of 611

A site serves its login page over HTTPS and the rest over HTTP. Why is this insufficient?

  1. Certificate validation fails on mixed content
  2. Search engines penalise mixed content
  3. HTTP pages cannot set cookies
  4. The session cookie sent once in the clear is a session stolen
Show the answer

Answer: D. The session cookie sent once in the clear is a session stolen

Protecting only the credential exchange leaves the session identifier exposed on every subsequent request.

Source: OWASP Transport Layer Security Cheat Sheet (OWASP) — OWASP Transport Layer Security Cheat Sheet › Use TLS Everywhere

Challenge yourself on this topic → Study as cards