A company processes credit card transactions and is subject to PCI DSS. Their web server currently supports TLS 1.2 with ECDHE-RSA-AES128-GCM-SHA256 and also TLS 1.0 with RC4 for an old point-of-sale system. The POS system cannot be upgraded immediately. Which action is the most appropriate to maintain compliance while keeping the POS system operational?

Disable TLS 1.0 and RC4 immediately, and require the POS system to be upgraded before any further transactions.

Move the POS system to a separate network segment and use a TLS-terminating proxy that presents strong TLS to the cardholder data environment, while the POS system uses the legacy protocol only on the isolated segment.

Keep TLS 1.0 and RC4 enabled but restrict access to the POS system's IP addresses.

Document the use of TLS 1.0 and RC4 as a risk acceptance and continue operations.

In an SSL/TLS cipher suite, what is the role of the key exchange algorithm?

It authenticates the server and optionally the client using digital certificates.

It securely establishes a shared secret between client and server to derive session keys.

It encrypts the application data transmitted between client and server.

It verifies the integrity of each transmitted record using a hash function.

An organization is migrating from a legacy TLS configuration to a more secure one. They currently support TLS 1.0, 1.1, and 1.2. They want to maintain compatibility with older clients while improving security. Which approach is the most balanced?

Immediately disable TLS 1.0 and 1.1, and require TLS 1.2.

Enable TLS 1.2 and 1.3, and disable TLS 1.0 and 1.1, while monitoring logs for any clients that fail to connect.

Keep TLS 1.0 and 1.1 enabled but disable all CBC ciphers and RC4.

Use a reverse proxy that terminates TLS and forwards traffic over HTTP to the backend.

A developer is configuring a web server and needs to choose a cipher suite that provides forward secrecy. Which cipher suite should the developer select?

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

EC-CouncilWeb Application Hacking and Security

Domain 5Objective 1

Weak SSL/TLS Ciphers WAHS Practice Questions (Page 8)

Part of the Cryptographic Failures and Transport Security domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 36–40

36expert · hard
A company processes credit card transactions and is subject to PCI DSS. Their web server currently supports TLS 1.2 with ECDHE-RSA-AES128-GCM-SHA256 and also TLS 1.0 with RC4 for an old point-of-sale system. The POS system cannot be upgraded immediately. Which action is the most appropriate to maintain compliance while keeping the POS system operational?
Select an answer first
37foundation · easy
In an SSL/TLS cipher suite, what is the role of the key exchange algorithm?
Select an answer first
38application · medium
An organization is migrating from a legacy TLS configuration to a more secure one. They currently support TLS 1.0, 1.1, and 1.2. They want to maintain compatibility with older clients while improving security. Which approach is the most balanced?
Select an answer first
39foundation · easy
Which attack exploits the use of CBC-mode ciphers in SSL/TLS to decrypt encrypted cookies or other sensitive data?
Select an answer first
40application · medium
A developer is configuring a web server and needs to choose a cipher suite that provides forward secrecy. Which cipher suite should the developer select?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Weak SSL/TLS Ciphers WAHS Practice Questions (Page 8)

Questions 36–40

In an SSL/TLS cipher suite, what is the role of the key exchange algorithm?

An organization is migrating from a legacy TLS configuration to a more secure one. They currently support TLS 1.0, 1.1, and 1.2. They want to maintain compatibility with older clients while improving security. Which approach is the most balanced?

Which attack exploits the use of CBC-mode ciphers in SSL/TLS to decrypt encrypted cookies or other sensitive data?

A developer is configuring a web server and needs to choose a cipher suite that provides forward secrecy. Which cipher suite should the developer select?

Keep studying — Cryptographic Failures and Transport Security