Attacking Encrypted Traffic GMOB Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team is testing a mobile app that uses TLS 1.2 with certificate pinning. The team wants to test the app's resistance to downgrade attacks. The app is installed on a test device that is rooted. Which approach would be most effective?

   • AUse a TLS scanner to test the server's cipher suites
   • BUse SSL stripping to convert HTTPS to HTTP
   • CUse ARP spoofing to redirect traffic to a malicious server
   • DUse a proxy with a custom CA and a pinning bypass to force the app to use TLS 1.0
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A network administrator notices a mobile device regularly connecting to a remote server on TCP port 443, but the traffic patterns are unusual: the packets are small, frequent, and occur at regular intervals. The administrator suspects data exfiltration. Which action would be most effective to confirm the suspicion?

   • ADecrypt the traffic using the server's private key
   • BIgnore the traffic because it is encrypted and cannot be analyzed
   • CPerform deep packet inspection on the TLS handshake and certificate details
   • DBlock all outbound traffic on port 443
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A forensic analyst is examining a mobile device that was used to access a corporate webmail service. The analyst has a full packet capture of the device's network traffic, but the TLS session is encrypted. The analyst also has a memory dump of the device. Which technique would be most effective to decrypt the TLS session?

   • AExtract the TLS session keys from the memory dump and use them to decrypt the captured traffic.
   • BPerform a brute-force attack on the TLS session key using the captured traffic.
   • CReplay the captured traffic to a test server to obtain the plaintext.
   • DUse the device's private key to decrypt the session.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   A mobile app connects to a server using TLS. The app's certificate validation process checks that the certificate is signed by a trusted root CA and that the certificate has not expired. Which critical validation step is missing from this process?

   • AConfirming that the certificate was issued within the last 90 days.
   • BEnsuring the certificate is not a self-signed certificate.
   • CVerifying that the certificate's subject name matches the hostname being connected to.
   • DChecking the certificate's key usage extension to ensure it is allowed for encryption.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a common defense against SSL stripping attacks?

   • AUsing HTTP Strict Transport Security (HSTS) to force browsers to use HTTPS.
   • BDisabling TLS compression.
   • CUsing a longer encryption key for the TLS session.
   • DImplementing certificate pinning in the browser.
   Reveal Solution Discussion Select an answer first