Attacking Encrypted Traffic GMOB Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security team is implementing a solution to detect downgrade attacks on their mobile devices. They have deployed a network monitoring tool that can analyze TLS handshakes. Which of the following metrics would be most useful for detecting a TLS downgrade attack?

   • AThe number of TLS handshake failures due to certificate errors.
   • BThe volume of HTTP traffic to sites that normally use HTTPS.
   • CThe distribution of TLS versions negotiated by clients.
   • DThe average size of TLS records.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A penetration tester is assessing a mobile application that communicates with a legacy server. The server supports TLS 1.2 and TLS 1.3, but the tester wants to force the client to use a weaker cipher. Which technique would be most effective in a lab environment where the tester controls the network path?

   • AUse ARP spoofing to redirect traffic to the tester's machine and then forward it unchanged.
   • BInstall a rogue CA certificate on the test device and perform a full MITM proxy.
   • CPerform a DNS spoofing attack to redirect the app to a fake server that only supports weak ciphers.
   • DModify the ClientHello message to advertise only weak cipher suites and a lower TLS version.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security analyst is investigating a suspected TLS interception on a corporate network. The analyst suspects that a rogue device is performing a man-in-the-middle attack. Which evidence would most strongly indicate a MITM attack?

   • AThe TLS certificate presented to the client is not signed by a trusted CA
   • BThe server certificate has a short validity period
   • CThe TLS handshake uses a weak cipher suite
   • DThe connection uses TLS 1.2
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A network administrator is reviewing firewall logs and notices a mobile device has established a long-lived TLS connection to a cloud storage provider. The connection is active during off-hours and transfers a small amount of data every few minutes. The device is not authorized to use cloud storage. Which of the following is the most likely explanation?

   • AThe device is using the cloud service for backup.
   • BThe device is exfiltrating data using an encrypted tunnel to a legitimate cloud service.
   • CThe device is performing a firmware update.
   • DThe device is infected with malware that is using a custom protocol over port 443.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   A mobile app uses certificate pinning to prevent man-in-the-middle attacks. Which of the following best describes how certificate pinning works?

   • AThe app requires the server to present a certificate that is signed by a specific intermediate CA.
   • BThe app periodically downloads a list of trusted certificates from a remote server.
   • CThe app uses a public key infrastructure to dynamically validate certificates against a central server.
   • DThe app is hardcoded to accept only a specific certificate or public key for a given server.
   Reveal Solution Discussion Select an answer first