Harden the payments TLS boundary
Try this labAll SY0-701 practice
- Certification
- SY0-701
- Format
- Artifact workspace
- Difficulty
- medium
- Estimated time
- 15 min
- Automated checks
- 8
SCENARIO
A scan of the public payments gateway found that clients can remain on HTTP, older TLS versions are enabled, and responses disclose the NGINX version. The existing HTTPS route and certificate are working and must stay intact.
TASK
Repair nginx.conf so HTTP permanently redirects to the matching HTTPS request, only TLS 1.2 and 1.3 are available, and HIGH ciphers exclude anonymous, MD5, and 3DES suites.
- Send one-year HSTS including subdomains on every response and suppress version disclosure.
- Preserve the working payments route, hostname, and certificate paths.