Web Communication Security GSEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network administrator is troubleshooting why some users cannot access a company website over HTTPS. The administrator checks the server and finds that TLS 1.0 is enabled and the certificate is valid. The users' browsers are modern and support TLS 1.2 and 1.3. The administrator wants to ensure secure communication while maintaining compatibility with older browsers that only support TLS 1.0. What is the best course of action?

   • AUse a self-signed certificate to avoid compatibility issues.
   • BKeep TLS 1.0 enabled but add HSTS to force HTTPS.
   • CDisable TLS 1.0 and require TLS 1.2 or higher, accepting that older browsers will no longer connect.
   • DEnable TLS 1.0 and TLS 1.2 simultaneously, and let the browser negotiate the highest version.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is setting up a new web server for a public-facing application. The security team requires that the server's certificate be trusted by all major browsers and that the private key be stored securely. The company also wants to automate certificate renewal to avoid manual intervention. Which solution best meets these requirements?

   • AUse an internal CA and install the root certificate on every client.
   • BUse a self-signed certificate and manually distribute it to all users.
   • CGenerate a certificate with a long validity period and store the private key on the server.
   • DUse a certificate from a public CA and automate renewal with the ACME protocol (e.g., Let's Encrypt).
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which type of attack is a WAF specifically designed to help prevent?

   • ADenial of service (DoS) at the network layer
   • BSQL injection
   • CMalware infections on end-user devices
   • DPhishing attacks
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which configuration is a best practice for securing web server communication?

   • AAllowing both HTTP and HTTPS to serve content
   • BEnabling TLS 1.0 for compatibility with older browsers
   • CDisabling weak cipher suites and enabling only strong, modern TLS versions
   • DUsing self-signed certificates to avoid the cost of a CA-issued certificate
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is migrating its public website to a new hosting provider. The site handles customer payments and must comply with PCI DSS. The security architect wants to ensure that all traffic is encrypted and that the site is protected against downgrade attacks. The company also wants to maintain compatibility with a small number of legacy clients that only support TLS 1.0. Which approach best balances security and compatibility?

   • AKeep TLS 1.0 enabled but only for non-payment pages, and use HSTS for all pages.
   • BDisable TLS 1.0 and 1.1, require TLS 1.2 or higher, and implement HSTS with a long max-age.
   • CEnable TLS 1.0, 1.1, 1.2, and 1.3, and rely on the browser to negotiate the highest version.
   • DUse a reverse proxy that terminates TLS and forwards traffic to the origin server over HTTP.
   Reveal Solution Discussion Select an answer first