Weak SSL/TLS Ciphers WAHS Practice Questions (Page 9)

Questions 41–43

1. 41foundation · easy

   What is the primary security risk when a web server supports export-grade cipher suites?

   • AThe server becomes vulnerable to denial-of-service attacks due to increased CPU usage.
   • BThe server cannot authenticate clients using client certificates.
   • CThe server's certificate is automatically revoked.
   • DAn attacker can downgrade the connection to use weak encryption and potentially decrypt traffic.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A large organization runs a legacy web application that must support a custom client built on an old TLS stack. The client only supports TLS 1.0 with CBC-mode ciphers and RC4. The security team must balance compliance with PCI DSS and the operational need to keep the client working. Which approach best addresses the conflict?

   • AEnable TLS 1.0 with RC4 only for the specific IP addresses of the legacy clients, and use strong ciphers for all other clients.
   • BDeploy a TLS-terminating reverse proxy that presents strong TLS to the internet and forwards traffic to the legacy application over an internal network using the legacy protocol.
   • CKeep the current configuration and document the risk as an accepted exception.
   • DForce the legacy client to upgrade by disabling TLS 1.0 and RC4 immediately.
   Reveal Solution Discussion Select an answer first
3. 43application · medium

   A security analyst is investigating a suspected man-in-the-middle attack on a web application. The server logs show that a client negotiated TLS_RSA_WITH_RC4_128_SHA. Which attack is most directly enabled by this cipher suite?

   • AAn attacker can perform a padding oracle attack because RC4 uses CBC mode.
   • BAn attacker can inject malicious data into the TLS stream because RC4 does not provide integrity checking.
   • CAn attacker can force the server to use export-grade RSA by tampering with the ClientHello message.
   • DA passive attacker can decrypt captured traffic because RC4 is a stream cipher with known biases.
   Reveal Solution Discussion Select an answer first