CyberCertPrepWeb App FundamentalsHTTP & Web BasicsEASYFree question
A pen tester discovers that a web server returns the exact same response body for a 404 and a 200 status code on certain endpoints - they only differ in the status line. What security testing problem does this create?
- A.It prevents TLS from establishing a secure connection
- B.It causes browser caches to cache 404 responses indefinitely
- C.It breaks automated security scanners and crawlers that rely on HTTP status codes to determine whether a resource exists, potentially masking the true surface area of the application during enumeration
- D.It makes it impossible to distinguish between GET and POST responses
Why C is correct
This pattern is called 'soft 404s' - returning 200 with a 'not found' page instead of a proper 404. It breaks automated tools (web crawlers, security scanners, link checkers) that use HTTP status codes to determine resource existence. From a security perspective, it can obscure the application's URL structure during reconnaissance, but it also prevents legitimate scanners from identifying real vulnerabilities. Proper status codes are essential for correct caching, SEO, and security tooling.
Know someone studying for Web App Fundamentals? Send them this one.