022.2 Web Encryption (weight: 2) SECURITY-ESSENTIALS Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A network administrator is analyzing a TLS handshake and sees that the client and server negotiate a cipher suite that uses RSA for key exchange. The administrator is concerned about forward secrecy. Which change should the administrator recommend?

   • ADisable TLS 1.0 and TLS 1.1.
   • BIncrease the RSA key size to 4096 bits.
   • CUse a longer session timeout.
   • DConfigure the server to prefer cipher suites that use ECDHE for key exchange.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a man-in-the-middle (MITM) attack in the context of web encryption?

   • AAn attacker floods a web server with traffic to make it unavailable
   • BAn attacker sends phishing emails to trick users into revealing credentials
   • CAn attacker intercepts and potentially alters communication between a client and server without either party knowing
   • DAn attacker installs malware on a user's device to steal data
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What does a browser verify to establish trust in a website's certificate chain?

   • AThat the certificate was issued by the same CA that issued the browser
   • BThat the certificate chain ends with a root certificate that is in the browser's trusted root store
   • CThat the certificate's encryption algorithm is the strongest available
   • DThat the website's IP address matches the certificate's subject
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security consultant is reviewing a web server's TLS configuration. The server currently supports TLS 1.0, TLS 1.1, and TLS 1.2. The consultant wants to improve security while maintaining compatibility with older browsers. Which action should the consultant recommend?

   • ADisable all TLS versions and use SSL 3.0 instead.
   • BEnable only TLS 1.3 and disable all other versions.
   • CDisable TLS 1.0 and TLS 1.1, keeping TLS 1.2 and TLS 1.3 if available.
   • DKeep TLS 1.0 and 1.1 enabled for maximum compatibility.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A large organization is planning to replace its public-facing web server's certificate. The current certificate is about to expire. The security team wants to minimize the risk of downtime and ensure that the new certificate is trusted by all clients. Which approach should they take?

   • AReuse the existing private key and request a new certificate with the same key.
   • BGenerate a new key pair and obtain a new certificate from the same CA before the old one expires.
   • CSwitch to a different CA without changing the key pair.
   • DWait until the certificate expires and then install the new one.
   Reveal Solution Discussion Select an answer first