A public web application must only be reached over HTTPS, and browsers should refuse plain HTTP even if a user types it. Which combination provides this?
Show answer and explanation
Answer: C
Layered controls cover the requirement. A policy enforces HTTPS-only on the web app or hosting service, a gateway such as Azure Front Door or Application Gateway terminates TLS, and the HSTS response header tells browsers to use HTTPS for future visits so they refuse plain HTTP. Guidance documents cannot enforce behavior, relying on users to type a scheme is unreliable, and client-only checks can be bypassed by calling the server directly.
Why the other options are wrong
- A. Guidance documents describe what should happen but enforce nothing, so a misconfigured deployment would still accept plain HTTP.
- B. End users cannot be relied on to type the correct scheme, and a link or bookmark using HTTP would still reach the site unencrypted.
- D. Client-side checks run on a device the operator does not control, so anyone calling the server directly bypasses them.