CA1-005: CompTIA SecurityXDemo

By CompTIA · Question Mode

QuestionQ2

Security Operations

A web application server that supports hybrid modern and legacy financial applications recently received a scheduled upgrade of common libraries, including OpenSSL. Multiple users now report unsuccessful attempts to connect to the server. The technician conducting initial triage identified the following:

  • Client applications older than five years appear to be affected most.
  • Web-server logs show initial connection attempts from affected hosts.
  • For the unsuccessful connections, the logs report "cipher unavailable."

Which of the following is the most likely safe remediation for this situation?

  • A The server needs to be configured for backward compatibility to SSL 3.0 applications.
  • B The client applications need to be modified to support AES in Galois/Counter Mode or equivalent.
  • C The client TLS configuration must be set to enforce electronic codebook modes of operation.
  • D The server-side digital signature algorithm needs to be modified to support elliptic curve cryptography.
Explanation

Older clients must be updated to negotiate a secure cipher suite supported by the upgraded server, such as AES-GCM with TLS 1.2 or later. OpenSSL documents AES-GCM cipher suites as TLS 1.2 suites and prohibits SSL 3.0 at security level 2. ECB is not a safe TLS mode, and a server signature-algorithm change does not resolve a cipher-suite mismatch.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!