Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security auditor is reviewing a web application that uses a custom encryption scheme for session tokens. The scheme uses a 64-bit key with a proprietary algorithm that is not publicly reviewed. The auditor also finds that the application uses RC4 for TLS connections. Which recommendation should the auditor make?

   • AReplace the proprietary algorithm with a well-vetted algorithm like AES-256, and replace RC4 with AES-GCM.
   • BKeep the proprietary algorithm but use a longer key and switch RC4 to AES-128.
   • CIncrease the key length of the proprietary algorithm to 256 bits and keep RC4 for TLS.
   • DUse the proprietary algorithm for session tokens and RC4 for TLS, as they are both fast.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is deploying a new web application and must support clients that use a variety of TLS versions. The security policy requires that all data be encrypted with at least 128-bit security and that the system be resistant to known attacks. The application will be accessed by both modern browsers and legacy embedded devices that only support TLS 1.1. What is the best approach?

   • AEnable TLS 1.1 with AES-128-CBC to support legacy devices
   • BUse a separate subdomain for legacy devices with TLS 1.1
   • CImplement TLS 1.1 with a strong cipher suite like AES-256-GCM
   • DDisable TLS 1.1 and require all clients to use TLS 1.2 or higher
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security auditor is reviewing a web server's TLS configuration and finds that it supports TLS 1.2 with the cipher suite TLS_RSA_WITH_AES_128_GCM_SHA256. The auditor notes that the server does not support any ECDHE or DHE key exchange. What is the primary concern?

   • AThe cipher suite uses a weak block cipher (AES-128 is weak)
   • BThe cipher suite uses a weak hash function (SHA-256 is weak)
   • CThe cipher suite does not provide forward secrecy
   • DThe cipher suite uses GCM mode, which is insecure
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is using Wireshark to capture traffic from a web application that uses HTTPS. The analyst sees that the ClientHello message lists several cipher suites, including TLS_RSA_WITH_3DES_EDE_CBC_SHA. What should the analyst conclude?

   • AThe server is using 3DES for the session
   • BThe traffic is encrypted with 3DES and is vulnerable to decryption
   • CThe client is offering a weak cipher suite, but the server may not accept it
   • DThe server is vulnerable to the Sweet32 attack because it supports 3DES
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network administrator is configuring a load balancer that terminates TLS for a set of internal applications. The applications are accessed by a mix of modern browsers and legacy clients. The security policy requires that all traffic be encrypted with at least TLS 1.2. What is the best approach to support legacy clients while meeting the policy?

   • AEnable TLS 1.0 and TLS 1.1 on the load balancer to ensure compatibility
   • BUse SSLv3 with a strong cipher suite to maintain compatibility
   • CTerminate TLS at the application level instead of the load balancer
   • DConfigure the load balancer to accept only TLS 1.2 and above, and update or replace legacy clients
   Reveal Solution Discussion Select an answer first