325.2 X.509 Certificates for Encryption, Signing and Authentication (weight: 4) LPIC-3-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary goal of a downgrade attack against TLS?

   • ATo replace the server's certificate with a self-signed one
   • BTo force the client and server to negotiate a weaker, less secure protocol version
   • CTo cause a denial of service by overwhelming the server with handshake requests
   • DTo decrypt the traffic by obtaining the private key
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A high-traffic e-commerce site uses Apache with mod_ssl. The security team wants to reduce the latency of TLS handshakes for clients by avoiding the need for clients to fetch the certificate revocation status from an external OCSP responder. Which Apache configuration should be enabled?

   • ASSLHonorCipherOrder on
   • BSSLCompression off
   • CSSLSessionTickets on
   • DSSLUseStapling on
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is investigating a potential Man-in-the-Middle attack where an attacker intercepts traffic between a client and a web server. The analyst notices that the client is connecting to the server using an older TLS version than the server supports. Which combination of measures would BEST mitigate this type of downgrade attack?

   • AEnable OCSP stapling and configure a longer session timeout.
   • BUse a stronger cipher suite and enable TLS session tickets.
   • CDisable older TLS versions on the server and enable HSTS on the HTTPS virtual host.
   • DConfigure client certificate authentication and increase SSLVerifyDepth.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of Server Name Indication (SNI) in TLS?

   • ATo compress the TLS handshake messages for faster negotiation
   • BTo allow a server to present different certificates for different hostnames on the same IP address
   • CTo authenticate the client using a certificate
   • DTo encrypt the server name in the TLS handshake to prevent eavesdropping
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company requires client certificate authentication for a web application. The administrator has configured SSLVerifyClient require and SSLCACertificateFile. However, some legitimate users are unable to connect, and the error log shows 'client certificate verification failed'. The administrator suspects the client certificates are being issued by an intermediate CA. What is the MOST likely cause of the failure?

   • AThe SSLVerifyDepth directive is set to 1, which is too low to validate a chain with an intermediate CA.
   • BThe SSLCACertificateFile only contains the root CA certificate, and the intermediate CA certificate is not included.
   • CThe SSLVerifyClient directive is set to optional instead of require.
   • DThe SSLCertificateKeyFile directive is missing from the virtual host configuration.
   Reveal Solution Discussion Select an answer first