A security analyst is investigating a report that a user's session was hijacked on a public Wi-Fi network. The analyst finds that the user visited a website over HTTPS, but the session cookie was stolen. Which vulnerability could have allowed this?

The website's certificate was self-signed.

The website used a weak cipher suite.

The user's browser did not support TLS 1.3.

The website did not set the Secure flag on the session cookie.

How does TLS help mitigate man-in-the-middle attacks?

By preventing the server from being attacked by malware

By encrypting the data and authenticating the server with a digital certificate

By blocking all traffic from suspicious IP addresses

By hiding the client's IP address from the server

In the TLS handshake, how does the client authenticate the server?

By verifying the server's digital certificate against a trusted certificate authority

By comparing the server's IP address with a list of known servers

By checking that the server's response time is within a normal range

By sending a secret password to the server that only the server knows

A small e-commerce site currently serves its checkout page over HTTP. The owner wants to protect customer payment details during transmission. The site is hosted on a shared server and the owner has a limited budget. Which action should be taken first?

Encrypt the database where payment details are stored.

Use a VPN for all customer connections to the site.

Obtain a certificate from a trusted CA and configure the web server to use HTTPS.

Install a self-signed certificate and configure the web server to use TLS.

LPI Security Essentials

Domain 2Objective 2

022.2 Web Encryption (weight: 2) SECURITY-ESSENTIALS Practice Questions (Page 6)

Part of the 022 Encryption domain, which makes up ~20% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

Questions 26–29

26expert · medium
A security analyst is investigating a report that a user's session was hijacked on a public Wi-Fi network. The analyst finds that the user visited a website over HTTPS, but the session cookie was stolen. Which vulnerability could have allowed this?
Select an answer first
27foundation · easy
How does TLS help mitigate man-in-the-middle attacks?
Select an answer first
28foundation · easy
In the TLS handshake, how does the client authenticate the server?
Select an answer first
29application · medium
A small e-commerce site currently serves its checkout page over HTTP. The owner wants to protect customer payment details during transmission. The site is hosted on a shared server and the owner has a limited budget. Which action should be taken first?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SECURITY-ESSENTIALS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “SECURITY-ESSENTIALS” is a trademark of its owner, used for identification only.