Weak SSL/TLS Ciphers WAHS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A network administrator notices that a web application supports the TLS_RSA_WITH_RC4_128_SHA cipher suite. The administrator is concerned about the risk of an attacker decrypting or modifying traffic. Which attack is most directly associated with the use of RC4 in TLS?

   • ARC4 biases allow statistical recovery of plaintext over many sessions.
   • BBEAST attack
   • CPOODLE attack
   • DFREAK attack
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which attack can be performed against a server that supports SSL 3.0, allowing an attacker to decrypt ciphertext by exploiting a padding oracle?

   • ADROWN
   • BBEAST
   • CFREAK
   • DPOODLE
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An administrator is configuring a new IIS web server and wants to ensure it uses only strong TLS 1.2 cipher suites. The server must support a wide range of modern clients. Which approach is the most effective for configuring the cipher suite order?

   • AEnable all cipher suites and let the client choose the first one in its list.
   • BUse the default Windows cipher suite order and only disable RC4.
   • CSet the registry to prefer the client's cipher suite order to maximize compatibility.
   • DDisable all weak cipher suites and order the remaining suites with ECDHE-ECDSA-AES256-GCM-SHA384 first, followed by other AEAD suites.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is preparing for a PCI DSS audit. The web server currently supports TLS 1.0 with RC4 and 3DES. The compliance team requires that all transmitted cardholder data be protected with strong cryptography. Which configuration change is most aligned with PCI DSS requirements?

   • ADisable TLS 1.0 and RC4, and enable TLS 1.2 or higher with strong cipher suites such as ECDHE-RSA-AES128-GCM-SHA256.
   • BKeep TLS 1.0 enabled but replace RC4 with 3DES to improve security.
   • CEnable TLS 1.2 but leave RC4 as a fallback for older browsers.
   • DUse TLS 1.0 with AES-CBC and a secure renegotiation extension.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is using Wireshark to analyze TLS traffic to a web server. They want to quickly identify if any weak cipher suites are being negotiated. Which field in the TLS handshake should they inspect?

   • AThe Application Data records
   • BThe Cipher Suite field in the ServerHello message
   • CThe Certificate message
   • DThe Server Name Indication (SNI) extension
   Reveal Solution Discussion Select an answer first