Attacking Encrypted Traffic GMOB Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is reviewing network logs and sees a mobile device using a DNS-over-HTTPS (DoH) service to resolve domains. The analyst is concerned that this could be used to hide malicious activity. Which action would be most effective to detect malicious DoH usage?

   • ABlock all DoH traffic at the firewall
   • BIgnore DoH traffic because it is encrypted
   • CDecrypt the DoH traffic using the private key of the DoH server
   • DMonitor the destination IPs and timing of DoH connections
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security architect is designing a detection system for encrypted traffic attacks. The system will monitor TLS handshakes and flag anomalies. The architect wants to minimize false positives while detecting both downgrade attacks and rogue certificate usage. Which combination of indicators would be most effective?

   • AMonitor for a decrease in the average TLS version across the network.
   • BMonitor for any TLS handshake that uses a cipher suite that is not in the top 10 most common.
   • CMonitor for an increase in TLS handshake failures.
   • DMonitor for TLS version downgrades on a per-device basis and for certificates that are not in the organization's approved CA list.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An attacker measures the power consumption of a mobile device while it performs cryptographic operations to deduce the secret key. What type of attack is this?

   • ABrute-force attack
   • BKey extraction attack
   • CLawful interception
   • DSide-channel attack
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team is evaluating the risk of TLS downgrade attacks on their mobile devices. They have a mix of devices, some running older operating systems that only support TLS 1.0, and others running the latest OS with TLS 1.3. They want to implement a detection mechanism that minimizes false positives. Which of the following approaches is most effective?

   • ABlock all TLS 1.0 traffic at the firewall.
   • BMonitor for a decrease in the average TLS version across all devices.
   • CMonitor for an increase in TLS handshake failures.
   • DMonitor for TLS handshakes that negotiate TLS 1.0 from devices that are known to support TLS 1.2 or higher.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following best describes 'lawful interception' in the context of encrypted traffic?

   • AA method for intercepting traffic using a rogue certificate.
   • BA legally authorized process for obtaining access to communications, often with the cooperation of service providers.
   • CA technique for recovering keys from a device's memory.
   • DAn attack that exploits a vulnerability in the TLS protocol to decrypt traffic.
   Reveal Solution Discussion Select an answer first