Attacking Encrypted Traffic GMOB Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is monitoring a corporate network and notices that a mobile device is sending a large amount of data to a cloud storage service using TLS. The analyst suspects data exfiltration but cannot decrypt the traffic. Which detection technique would be most effective?

   • ABlock all traffic to the cloud storage service
   • BPerform a man-in-the-middle attack to decrypt the traffic
   • CAnalyze the traffic flow metadata, such as destination IP, timing, and volume
   • DIgnore the traffic because it is encrypted
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester is assessing a mobile banking app. The app uses certificate pinning and only allows HTTPS connections. The tester wants to capture the app's API traffic. Which approach is most likely to succeed?

   • ADowngrade the TLS version to SSLv3
   • BUse DNS spoofing to redirect the app to a malicious server
   • CPerform SSL stripping to force HTTP
   • DInstall a custom CA certificate and use a proxy with SSL pinning bypass
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A penetration tester is performing a wireless assessment. The tester wants to intercept and decrypt HTTPS traffic from a mobile device on the same Wi-Fi network. The tester has already installed a rogue CA certificate on the device. Which additional step is required to complete the MITM attack?

   • AConfigure the device's DNS to point to the tester's server.
   • BDisable the device's Wi-Fi and reconnect to a rogue access point.
   • CEnable IP forwarding on the tester's machine.
   • DPerform ARP spoofing to redirect the device's traffic through the tester's machine.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is testing a mobile app's TLS implementation. The analyst notices that the app accepts any certificate signed by a CA that is in the device's trust store. The analyst wants to test the app's resistance to rogue CA attacks. Which action would be most effective?

   • AUse a self-signed certificate on the proxy
   • BUse a different proxy tool
   • CInstall a custom CA in the device's trust store and use a proxy to present a certificate signed by that CA
   • DDisable the device's network security configuration
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A network security team is trying to detect data exfiltration over encrypted tunnels. They have implemented a solution that inspects TLS handshake metadata and flags connections to known file-sharing services. However, they are seeing many false positives because employees legitimately use these services. Which of the following enhancements would most reduce false positives while still detecting exfiltration?

   • AUse deep packet inspection to decrypt the TLS traffic.
   • BBlock all traffic to file-sharing services.
   • CIncrease the frequency of TLS handshake inspections.
   • DCorrelate the TLS handshake metadata with user authentication logs and data loss prevention (DLP) alerts.
   Reveal Solution Discussion Select an answer first