2.11 Identify the Certificate Components in a Given Scenario 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security analyst is reviewing a TLS handshake and sees that the client and server negotiated TLS 1.2 with the cipher suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. The analyst notices that the server's certificate is signed with SHA-1. What is the most significant security concern?

   • AThe ECDHE key exchange is vulnerable to man-in-the-middle attacks.
   • BThe TLS 1.2 protocol is outdated and should be replaced with TLS 1.3.
   • CThe SHA-1 signature on the certificate weakens the authentication of the server.
   • DThe AES-128-GCM encryption is too weak for sensitive data.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is examining a certificate and sees the following fields: Subject: CN=mail.example.com, Issuer: CN=Example Root CA, Validity: Not Before Jan 1 2024, Not After Jan 1 2025, Public Key: RSA 2048, Extensions: Subject Alternative Name (SAN) includes mail.example.com and smtp.example.com. The analyst wants to confirm that the certificate can be used for both mail and SMTP services. Which field is most relevant for this purpose?

   • ASubject Alternative Name
   • BValidity
   • CSubject
   • DPublic Key
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security engineer is designing a TLS 1.2 configuration for a high-traffic e-commerce platform. The platform must support legacy clients that only support RSA key exchange, but the security policy requires forward secrecy for all sessions. The engineer cannot upgrade the legacy clients. What is the best approach to balance security and compatibility?

   • AUse RSA key exchange for all clients to ensure compatibility.
   • BDisable all RSA key exchange cipher suites and require all clients to upgrade.
   • CImplement a reverse proxy that terminates TLS and re-encrypts using ECDHE for all clients.
   • DConfigure the server to prefer ECDHE cipher suites but allow RSA key exchange as a fallback for legacy clients.
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   A security analyst is troubleshooting a TLS 1.2 connection that fails only for clients on the corporate network, while external clients can connect successfully. The server presents a certificate issued by an internal CA. The internal CA certificate is not in the trust store of the corporate clients, but it is in the trust store of external clients. What is the most likely cause?

   • AThe corporate clients do not trust the internal CA certificate.
   • BThe server certificate has a different subject name for corporate clients.
   • CThe server is not sending the intermediate certificate to corporate clients.
   • DThe corporate clients are using a different TLS version than external clients.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is comparing two TLS configurations: one uses RSA key exchange and the other uses ECDHE. The analyst is concerned about the impact of a server private key compromise on past sessions. Which statement accurately describes the difference?

   • ABoth RSA and ECDHE provide forward secrecy
   • BNeither RSA nor ECDHE provides forward secrecy
   • CECDHE provides forward secrecy, so past session keys remain protected after a private key compromise
   • DRSA key exchange provides forward secrecy, so past session keys remain protected
   Reveal Solution Discussion Select an answer first