A mobile app is vulnerable to man-in-the-middle attacks because it does not properly validate server certificates. Which of the following is the most effective mitigation?

Disabling TLS compression to reduce attack surface.

Implementing proper certificate validation, including hostname verification and chain-of-trust checks.

Switching to a different TLS library.

Using a longer encryption key for the TLS session.

A penetration tester is assessing a mobile app that uses TLS 1.2. The tester wants to test if the server can be forced to use a weaker cipher suite. Which tool or technique would be most appropriate?

Use ARP spoofing to redirect traffic to a malicious server

Use SSL stripping to convert HTTPS to HTTP

Use a TLS scanner to identify supported cipher suites and test for downgrade

Use a brute-force attack on the TLS handshake

A security analyst is testing the organization's mobile device management (MDM) solution. The analyst wants to verify that the MDM agent properly validates the server certificate when communicating with the MDM server. The analyst sets up a rogue access point and uses a proxy to intercept the agent's traffic. The agent connects successfully, but the analyst cannot see the plaintext traffic. Which action would most likely allow the analyst to view the plaintext traffic?

Disable the device's Wi-Fi and use a cellular connection

Use ARP spoofing instead of a rogue access point

Install the analyst's CA certificate in the device's trusted root store

Configure the proxy to forward traffic without modifying certificates

During a network capture, an analyst sees a large volume of TLS-encrypted traffic. Which of the following is the most reliable way to determine the application-layer protocol (e.g., HTTP, SMTP) being used inside the TLS tunnel?

Decrypt the traffic using the server's private key.

Perform deep packet inspection on the encrypted payload.

Look at the TCP port number in the packet header.

Inspect the Server Name Indication (SNI) field in the TLS ClientHello.

GIAC Mobile Device Security Analyst

Domain 3Objective 1

Attacking Encrypted Traffic GMOB Practice Questions (Page 3)

Part of the Network Traffic Manipulation and Security domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 11–15

11foundation · easy
A mobile app is vulnerable to man-in-the-middle attacks because it does not properly validate server certificates. Which of the following is the most effective mitigation?
Select an answer first
12application · medium
A penetration tester is assessing a mobile app that uses TLS 1.2. The tester wants to test if the server can be forced to use a weaker cipher suite. Which tool or technique would be most appropriate?
Select an answer first
13application · medium
A security analyst is testing the organization's mobile device management (MDM) solution. The analyst wants to verify that the MDM agent properly validates the server certificate when communicating with the MDM server. The analyst sets up a rogue access point and uses a proxy to intercept the agent's traffic. The agent connects successfully, but the analyst cannot see the plaintext traffic. Which action would most likely allow the analyst to view the plaintext traffic?
Select an answer first
14foundation · easy
During a network capture, an analyst sees a large volume of TLS-encrypted traffic. Which of the following is the most reliable way to determine the application-layer protocol (e.g., HTTP, SMTP) being used inside the TLS tunnel?
Select an answer first
15foundation · easy
An attacker forces a client and server to negotiate a weaker encryption protocol, such as SSL 3.0 instead of TLS 1.2, to exploit known vulnerabilities. What is this attack technique called?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.

Attacking Encrypted Traffic GMOB Practice Questions (Page 3)

Questions 11–15

A mobile app is vulnerable to man-in-the-middle attacks because it does not properly validate server certificates. Which of the following is the most effective mitigation?

A penetration tester is assessing a mobile app that uses TLS 1.2. The tester wants to test if the server can be forced to use a weaker cipher suite. Which tool or technique would be most appropriate?

During a network capture, an analyst sees a large volume of TLS-encrypted traffic. Which of the following is the most reliable way to determine the application-layer protocol (e.g., HTTP, SMTP) being used inside the TLS tunnel?

An attacker forces a client and server to negotiate a weaker encryption protocol, such as SSL 3.0 instead of TLS 1.2, to exploit known vulnerabilities. What is this attack technique called?

Keep studying — Network Traffic Manipulation and Security