Weak SSL/TLS Ciphers WAHS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is investigating a potential downgrade attack on a web server. The server supports TLS 1.2 with strong ciphers, but also supports TLS 1.0 with RC4. The analyst suspects that an attacker is forcing clients to downgrade to TLS 1.0. Which attack technique is most likely being used?

   • AThe attacker is exploiting a buffer overflow in the server's TLS implementation.
   • BThe attacker is performing a man-in-the-middle attack and modifying the ClientHello to remove all strong cipher suites.
   • CThe attacker is using a denial-of-service attack to overwhelm the server and force it to use a weaker cipher.
   • DThe attacker is stealing the server's private key and using it to decrypt traffic.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is reviewing the TLS configuration of a web application. The server supports TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA and TLS_RSA_WITH_AES_128_GCM_SHA256. Which suite is more resistant to a BEAST attack?

   • ANeither is resistant because BEAST affects all TLS 1.0 connections.
   • BTLS_RSA_WITH_AES_128_GCM_SHA256
   • CBoth are equally resistant because they use 128-bit AES.
   • DTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization is hardening its web server and wants to disable all export-grade cipher suites. Which configuration change is most effective?

   • AEnable TLS 1.3 and leave the existing cipher configuration unchanged.
   • BSet the server to prefer ECDHE suites over RSA suites.
   • CRemove all cipher suites that contain 'EXP' in their name and disable SSLv3.
   • DIncrease the RSA key length to 4096 bits.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A penetration tester is assessing a web server and needs to identify which cipher suites are supported. The tester wants to determine if any export-grade ciphers are enabled, which could allow FREAK attacks. Which tool or technique is most appropriate for this task?

   • ARun an SSL/TLS scanner such as sslyze or testssl.sh against the server.
   • BInspect the server's HTTP response headers for 'Strict-Transport-Security'.
   • CPerform a port scan with Nmap to identify open ports and services.
   • DUse netcat to connect to port 443 and manually read the server certificate.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a recommended practice when configuring TLS on a web server?

   • APrioritize cipher suites that provide forward secrecy, such as ECDHE
   • BEnable all cipher suites for maximum compatibility
   • CDisable TLS 1.2 to prevent BEAST attacks
   • DUse SSL 3.0 for legacy clients
   Reveal Solution Discussion Select an answer first