Certified Ethical Hacker (CEH) Practice Question

The captured cookies were exposed because browsers were willing to communicate with the site over plain HTTP. Enabling the Strict-Transport-Security (HSTS) header instructs compliant browsers to refuse all future connections to the domain over HTTP and automatically convert them to HTTPS. This eliminates the opportunity for an attacker to downgrade a victim's connection or sniff cookies in cleartext. The other headers improve security in different areas-X-Content-Type-Options blocks MIME-type sniffing, Cache-Control controls client and proxy caching, and a basic Content-Security-Policy sandbox directive limits certain script capabilities-but none of them force transport encryption, so they would not stop session hijacking performed through unsecured HTTP.