🛡️ Free practice test question from: threat vectors (Security+)

In this situation, the financial services company has implemented HTTPS to protect sensitive user data, but attackers have found a way to downgrade secure connections to unsecured HTTP. This is a critical security vulnerability known as a "SSL/TLS Downgrade Attack" or "Protocol Downgrade Attack".

Part of it can be so called: SSL Stripping (also known as HTTPS Stripping) that is a specific type of man-in-the-middle attack that forces a secure HTTPS connection to degrade to an insecure HTTP connection.

Why HSTS is the Best Solution: HTTP Strict Transport Security (HSTS) is a web security mechanism that completely prevents connection downgrade attacks by instructing web browsers to:

→ Always use HTTPS when connecting to a specific domain

→ Automatically convert all HTTP requests to HTTPS before making the connection

→ Prevent users from bypassing security warnings for invalid certificates