HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 16)

Questions 76–77

1. 76application · medium

   A SOC analyst is investigating a potential man-in-the-middle attack. The analyst captures TLS traffic between a client and a server. The client sends a ClientHello message, and the server responds with a ServerHello, Certificate, and ServerHelloDone. The analyst notices that the certificate is self-signed and the client's browser displays a warning. The client proceeds anyway. Which conclusion is most consistent with this observation?

   • AThe server is using a valid certificate from a trusted CA, and the warning is a false positive
   • BThe client is vulnerable to a man-in-the-middle attack because it accepted a self-signed certificate that was not validated against a trusted CA
   • CThe server is using a valid certificate, but the client's clock is incorrect
   • DThe client is using a corporate TLS inspection proxy that re-issues certificates
   Reveal Solution Discussion Select an answer first
2. 77foundation · easy

   What information is typically found in a web server access log?

   • AThe full database schema
   • BClient IP address, request method, URL, and status code
   • CThe contents of the request body
   • DThe server's private key
   Reveal Solution Discussion Select an answer first