A proxy-based man-in-the-middle attack on TLS traffic typically requires the client to trust a certificate installed by the attacker. Why is this necessary?

To ensure the proxy can cache the encrypted traffic for later analysis.

To enable the proxy to use a stronger encryption algorithm than the original server.

To allow the proxy to bypass certificate revocation checks.

So the proxy can present a valid certificate for the target domain and decrypt the traffic.

A security analyst is conducting a penetration test on a mobile app that uses certificate pinning. The analyst has installed a custom CA on the test device, but the app still rejects the proxy's certificate. The analyst suspects the app is using pinning. Which technique would be most effective to bypass the pinning?

Use runtime instrumentation to hook the certificate validation function

Install the proxy's certificate in the system trust store

Disable the device's network security configuration

A mobile app developer is implementing TLS for a new app. The developer wants to prevent man-in-the-middle attacks that use rogue certificates. Which implementation choice would be most effective?

Disable certificate validation for faster connections

Implement certificate pinning in the app

Use a self-signed certificate on the server

A security analyst is troubleshooting why a corporate mobile device cannot connect to a cloud service after a network change. The device is configured to use a proxy for all traffic. The analyst captures traffic and sees a TLS handshake failure with an 'unknown certificate authority' error. Which of the following is the most likely cause?

The proxy is using TLS 1.3, which the device does not support.

The device's DNS resolver is returning a spoofed IP address.

The proxy is presenting a certificate that is not trusted by the device.

The cloud service has revoked its certificate.

An attacker uses a TLS connection to a legitimate cloud service to send stolen data from a compromised mobile device. Why is this an effective exfiltration technique?

The encrypted traffic blends in with normal HTTPS traffic and is difficult to distinguish from legitimate activity.

TLS encrypts the destination IP address, hiding the exfiltration server.

TLS encryption prevents the cloud service from logging the data.

TLS uses a special protocol that bypasses firewalls.

GIAC Mobile Device Security Analyst

Domain 3Objective 1

Attacking Encrypted Traffic GMOB Practice Questions (Page 5)

Part of the Network Traffic Manipulation and Security domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 21–25

21foundation · easy
A proxy-based man-in-the-middle attack on TLS traffic typically requires the client to trust a certificate installed by the attacker. Why is this necessary?
Select an answer first
22expert · hard
A security analyst is conducting a penetration test on a mobile app that uses certificate pinning. The analyst has installed a custom CA on the test device, but the app still rejects the proxy's certificate. The analyst suspects the app is using pinning. Which technique would be most effective to bypass the pinning?
Select an answer first
23application · medium
A mobile app developer is implementing TLS for a new app. The developer wants to prevent man-in-the-middle attacks that use rogue certificates. Which implementation choice would be most effective?
Select an answer first
24application · medium
A security analyst is troubleshooting why a corporate mobile device cannot connect to a cloud service after a network change. The device is configured to use a proxy for all traffic. The analyst captures traffic and sees a TLS handshake failure with an 'unknown certificate authority' error. Which of the following is the most likely cause?
Select an answer first
25foundation · easy
An attacker uses a TLS connection to a legitimate cloud service to send stolen data from a compromised mobile device. Why is this an effective exfiltration technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMOB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMOB” is a trademark of its owner, used for identification only.

Attacking Encrypted Traffic GMOB Practice Questions (Page 5)

Questions 21–25

A proxy-based man-in-the-middle attack on TLS traffic typically requires the client to trust a certificate installed by the attacker. Why is this necessary?

A mobile app developer is implementing TLS for a new app. The developer wants to prevent man-in-the-middle attacks that use rogue certificates. Which implementation choice would be most effective?

An attacker uses a TLS connection to a legitimate cloud service to send stolen data from a compromised mobile device. Why is this an effective exfiltration technique?

Keep studying — Network Traffic Manipulation and Security