Weak Cryptographic Algorithms or Protocols WAHS Practice Questions (Page 7)

Questions 31–34

1. 31application · medium

   A network administrator is configuring a load balancer that terminates TLS for a web application. The administrator wants to ensure that only secure protocols are used. Which protocol versions should be explicitly disabled in the load balancer configuration?

   • ASSLv2, SSLv3, TLS 1.0, and TLS 1.1
   • BTLS 1.2 and TLS 1.3
   • CSSLv2 and TLS 1.3 only
   • DSSLv3 and TLS 1.2 only
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company is developing a mobile app that communicates with a backend server. The app uses a certificate pinned to the server's public key. The server's certificate is signed with SHA-1 and uses a 1024-bit RSA key. The company wants to update the certificate to improve security. Which change should be made?

   • AUse an ECDSA key with SHA-1 signature to reduce key size.
   • BUse a 2048-bit RSA key but keep the SHA-1 signature for compatibility.
   • CGenerate a new certificate with a 2048-bit RSA key and sign it with SHA-256.
   • DKeep the 1024-bit RSA key but sign the certificate with SHA-256.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst is reviewing the cryptographic settings of a web application that uses a database to store credit card numbers. The application encrypts the data using RSA with a 1024-bit key. The analyst also notices that the application uses a self-signed certificate. Which recommendation should the analyst make?

   • AReplace the RSA key with a 2048-bit or larger key and use a certificate signed by a trusted CA.
   • BKeep the 1024-bit RSA key but use a certificate signed by a trusted CA.
   • CUse a 2048-bit RSA key but keep the self-signed certificate for internal use.
   • DSwitch to DES encryption for the database and keep the self-signed certificate.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is designing a new API that will handle sensitive financial data. The API will be accessed by mobile apps and web clients. Which cryptographic configuration should be used to protect data in transit?

   • AUse SSLv3 with 3DES for maximum compatibility.
   • BUse TLS 1.0 with RC4 for compatibility with older mobile devices.
   • CEnforce TLS 1.2 or higher with ECDHE and AES-GCM cipher suites.
   • DUse TLS 1.2 with RSA key exchange and CBC cipher suites.
   Reveal Solution Discussion Select an answer first