CyberCertPrepWeb App FundamentalsHTTP & Web BasicsEASYFree question
What is the default TCP port for HTTP and HTTPS respectively, and why can these defaults matter in security configurations?
- A.HTTP: 8080, HTTPS: 8443 - the 'safe' ports required for non-privileged web servers
- B.HTTP: 443, HTTPS: 80 - reversed to prevent automated scanners from detecting HTTPS services
- C.HTTP: 80, HTTPS: 8443 - HTTPS uses a dedicated high port to separate traffic from HTTP
- D.HTTP: 80, HTTPS: 443 - knowing the defaults matters because firewall rules, WAFs, and browser security policies often apply differently to well-known ports versus custom ports; for example, HSTS applies to port 443 and browsers apply stricter mixed-content rules to port 80
Why D is correct
HTTP defaults to TCP/80, HTTPS to TCP/443. These are IANA-assigned well-known ports. From a security standpoint: HSTS (HTTP Strict Transport Security) applies to the hostname on port 443 by default; other HTTPS ports require explicit port specification in the HSTS header. Mixed content blocking works differently by port. SSRF filters often check for redirects to port 80 (HTTP) as a downgrade signal. Firewall rules and WAF policies commonly use port as a traffic classifier. Running services on non-standard ports doesn't provide security through obscurity but changes default behavior.
Know someone studying for Web App Fundamentals? Send them this one.