Weak SSL/TLS Ciphers WAHS Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security engineer is reviewing a proposed TLS configuration for a new web service. The configuration includes TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_128_GCM_SHA256. The engineer wants to ensure that the service provides forward secrecy for all sessions. What should the engineer do?

   • AKeep both suites and rely on the server's preference for ECDHE.
   • BRemove TLS_RSA_WITH_AES_128_GCM_SHA256 and keep only ECDHE-based suites.
   • CReplace the RSA suite with TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 to maintain forward secrecy.
   • DEnable TLS 1.3, which automatically provides forward secrecy for all sessions.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security consultant is reviewing a client's TLS configuration and finds that the server supports TLS 1.0 with CBC-mode ciphers. The client is not subject to PCI DSS but wants to align with NIST guidelines. Which recommendation is most appropriate?

   • ADisable TLS 1.0 and require TLS 1.2 or higher, as NIST guidelines recommend against TLS 1.0.
   • BUpgrade to TLS 1.1 and keep CBC-mode ciphers.
   • CUse TLS 1.0 with AES-GCM ciphers, which are strong enough.
   • DKeep TLS 1.0 but disable CBC-mode ciphers and use only RC4.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A system administrator is configuring a web server that must support a legacy application used by a small number of internal users. The application only works with TLS 1.0 and RC4. The administrator wants to minimize the risk while keeping the application functional. Which approach is the most appropriate?

   • AUse a reverse proxy that terminates TLS with strong ciphers and forwards traffic to the legacy application over a secure internal channel.
   • BKeep TLS 1.0 and RC4 enabled but only for internal users, and use strong ciphers for external users.
   • CDisable TLS 1.0 and RC4, and upgrade the application to support modern TLS.
   • DKeep TLS 1.0 and RC4 enabled but restrict access to the application to a specific internal network segment.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A large enterprise runs a legacy web application that is critical to operations. The application is used by both internal employees and external partners, some of whom use very old browsers that only support TLS 1.0 with RC4. The enterprise must comply with PCI DSS because the application processes credit card payments. The security team is tasked with remediating the weak cipher usage without causing a business outage. Which approach is the most appropriate?

   • AImmediately disable TLS 1.0 and RC4, and require all clients to upgrade to modern browsers.
   • BUse a load balancer that terminates TLS and forwards traffic over HTTP to the backend.
   • CDeploy a TLS termination proxy that supports strong ciphers, and restrict access to the legacy application through a VPN for external partners.
   • DKeep TLS 1.0 and RC4 enabled but only for external partners, and use strong ciphers for internal employees.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security engineer is reviewing the TLS configuration of a legacy web application that must remain compatible with older embedded devices. The current configuration supports TLS 1.0 with CBC-mode ciphers and RC4. The engineer needs to reduce the risk of BEAST and other CBC-related attacks while maintaining compatibility with the legacy devices. Which action is the most appropriate first step?

   • AEnable TLS 1.2 alongside TLS 1.0 and configure cipher suite ordering to prefer TLS 1.2 with AES-GCM, while leaving RC4 as a last-resort fallback for legacy devices.
   • BKeep TLS 1.0 enabled but prioritize RC4 over CBC ciphers to mitigate BEAST.
   • CDisable all CBC ciphers and require the use of TLS 1.2 with ECDHE-RSA-AES128-SHA.
   • DDisable RC4 and enable TLS 1.2 with only AEAD ciphers such as AES-GCM.
   Reveal Solution Discussion Select an answer first