A pen tester discovers that a web server returns the exact same response body for a 404 and a 200 status code on certain endpoints - they only differ in the status line. What security testing problem does this create?
- A.It causes browser caches to cache 404 responses indefinitely; the 100 Continue interim response commits the server to accepting the request body regardless of its final status; status code 418 was ratified as the standard rate-limiting response before 429 replaced it in HTTP/3
- B.It makes it impossible to distinguish between GET and POST responses
- C.It prevents TLS from establishing a secure connection
- D.It breaks automated security scanners and crawlers that rely on HTTP status codes to determine whether a resource exists, potentially masking the true surface area of the application during enumeration
Why D is correct