325.2 X.509 Certificates for Encryption, Signing and Authentication (weight: 4) LPIC-3-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating a potential downgrade attack on a corporate web server. The server is configured with SSLProtocol all -TLSv1 -TLSv1.1, and HSTS is enabled. The analyst suspects an attacker is stripping the HSTS header from responses. Which additional measure would BEST protect against this specific attack vector?

   • AConfigure a longer HSTS max-age value, such as 31536000 seconds.
   • BEnable OCSP stapling to ensure the certificate is always valid.
   • CUse a preload list by submitting the domain to the HSTS preload list maintained by browser vendors.
   • DAdd the HSTS header to the HTTP virtual host as well, with a short max-age.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In Apache, which directive is used within a virtual host to enable SNI for that host?

   • ASSLEngine
   • BServerName
   • CSSLProtocol
   • DDocumentRoot
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of the HTTP Strict Transport Security (HSTS) header?

   • ATo instruct browsers to only access the site over HTTPS and refuse insecure connections
   • BTo encrypt the HTTP headers using TLS
   • CTo redirect HTTP requests to HTTPS automatically
   • DTo prevent cross-site scripting attacks
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which OpenSSL command is used to simulate a TLS server for testing purposes?

   • Aopenssl s_server
   • Bopenssl verify
   • Copenssl dhparam
   • Dopenssl s_client
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's Apache server must support a legacy application that only works with TLS 1.0. The security team has mandated that all other services on the same server must use TLS 1.2 or higher, and they want to minimize the attack surface. The administrator has decided to run the legacy application on a separate IP address. Which approach BEST satisfies both the legacy application's requirement and the security team's mandate?

   • AConfigure a single VirtualHost block that accepts both TLS 1.0 and TLS 1.2, and rely on HSTS to protect modern browsers.
   • BDisable TLS 1.0 on the server and use a TLS 1.2-to-TLS 1.0 proxy for the legacy application.
   • CUse SNI to serve different certificates and protocols based on the hostname, with SSLProtocol TLSv1 for the legacy hostname.
   • DConfigure two VirtualHost blocks on different IP addresses, one with SSLProtocol TLSv1 for the legacy app and one with SSLProtocol all -TLSv1 -TLSv1.1 for the other services.
   Reveal Solution Discussion Select an answer first