Security Features — Test 1

Correct Answer: B. The connection to the site is encrypted (HTTPS), not that the site is trustworthy
Explanation: Phishing sites can easily obtain valid TLS certificates. ALSO KNOW (related points): • What does a browser certificate warning such as NET::ERR_CERT_DATE_INVALID indicate? → The site's TLS certificate has expired or the computer's clock is wrong

Correct Answer: B. Scripts from one origin (scheme, host, and port) cannot freely read data from another origin
Explanation: https://a.com and http://a.com are different origins, because their schemes differ. ALSO KNOW (related points): • Which manifest version is Chrome's current extension platform? → Manifest V3

Correct Answer: B. The browser, based on headers sent by the server
Explanation: Tools like curl ignore CORS. It protects users in browsers, not the server itself.

Correct Answer: A. Modern browsers block it as active mixed content
Explanation: Browsers may automatically upgrade some passive mixed content, such as images. ALSO KNOW (related points): • What does HSTS (HTTP Strict Transport Security) tell the browser? → To always use HTTPS for that domain for a set period, refusing plain HTTP connections

Correct Answer: D. To always use HTTPS for that domain for a set period, refusing plain HTTP connections
Explanation: HSTS is sent through the Strict-Transport-Security response header.

Correct Answer: C. No; major browsers support HTTP/2 only over TLS (HTTPS)
Explanation: The specification allows cleartext h2c, but browsers chose not to implement it.

Correct Answer: B. The site's TLS certificate has expired or the computer's clock is wrong
Explanation: A system clock that is set to the wrong date is a common, overlooked cause.

Correct Answer: D. Manifest V3
Explanation: Manifest V3 replaced background pages with service workers and limits blocking webRequest. This affected many ad blockers.