Attacking Encrypted Traffic GMOB Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is monitoring network traffic and notices a mobile device is communicating with a known command-and-control server using TLS on port 443. The traffic pattern is unusual: the packets are small, regular, and occur at the same time every day. Which of the following is the most appropriate next step?

   • AAnalyze the TLS handshake metadata, such as the server name indication (SNI) and certificate details, to identify the malware.
   • BBlock the IP address of the command-and-control server at the firewall.
   • CIsolate the device from the network and conduct a forensic analysis.
   • DPerform a deep packet inspection of the TLS traffic to identify the malware.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team is investigating a mobile app that uses certificate pinning. They discover that the app is vulnerable to a man-in-the-middle attack because it does not validate the certificate chain correctly. Which attack would be most directly enabled by this vulnerability?

   • AAn attacker could brute-force the app's encryption keys
   • BAn attacker could downgrade the app to use HTTP
   • CAn attacker could present a self-signed certificate and intercept the app's traffic
   • DAn attacker could perform a denial-of-service attack on the app server
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is investigating a report that users on the corporate Wi-Fi network see a browser warning when visiting a popular news site. The analyst captures traffic and notices that the site's HTTPS requests are being redirected to HTTP on port 80, and the HTTP responses contain a 302 redirect back to HTTPS. However, some users still see the warning. Which technique is most likely being used, and what is the primary reason the warning appears?

   • ADNS spoofing that resolves the site to an attacker-controlled IP; the warning appears because the IP address does not match the certificate's subject alternative name.
   • BA rogue certificate installed on the client; the warning appears because the browser detects the certificate is not issued by a trusted CA.
   • CA TLS downgrade attack that forces the server to use TLS 1.0; the warning appears because TLS 1.0 is deprecated and flagged by modern browsers.
   • DSSL stripping with a rogue proxy; the warning appears because the initial HTTPS request is intercepted and replaced with HTTP before the browser can establish a secure session.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a technique used to detect malicious activity in encrypted traffic without decrypting it?

   • ABlocking all TLS traffic to prevent encrypted attacks.
   • BTraffic analysis based on packet sizes, timing, and flow metadata.
   • CInspecting the plaintext payload after decrypting with the server's private key.
   • DUsing a firewall to block traffic on port 443.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is reviewing a packet capture of a mobile device's TLS traffic. The capture shows a ClientHello with TLS 1.2 and a cipher suite of TLS_RSA_WITH_AES_128_CBC_SHA. The server responds with a ServerHello selecting the same cipher suite. Which of the following is the most significant security concern?

   • AThe use of RSA key exchange makes the session vulnerable to decryption if the server's private key is compromised.
   • BThe use of CBC mode is vulnerable to padding oracle attacks.
   • CThe use of TLS 1.2 is outdated and should be replaced with TLS 1.3.
   • DThe use of AES-128 is too weak and can be broken by brute force.
   Reveal Solution Discussion Select an answer first