CA1-005: CompTIA SecurityXDemo

Question

A vulnerability scan of a web server found the following:

Question Image

Which of the following actions would be most likely to eliminate on-path decryption attacks?

Choose two

A Disallowing cipher suites that use ephemeral modes of operation for key agreement
B Removing support for CBC-based key exchange and signing AIgorithms
C Adding TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA256
D Implementing HIPS rules to identify and block BEAST attack attempts
E Restricting cipher suites to only allow TLS_RSA_WITH_AES_128_CBC_SHA
F Increasing the key length to 256 for TLS_RSA_WITH_AES_128_CBC_SHA

Explanation

CBC-mode TLS suites are susceptible to on-path attack classes that exploit the construction, so eliminating CBC-based support removes that exposure. An ECDHE AES-GCM suite uses ephemeral Diffie-Hellman key agreement and authenticated encryption rather than CBC, providing forward secrecy and avoiding CBC-mode weaknesses. TLS 1.2 defines ECDHE/ECDSA AES-GCM cipher suites as authenticated-encryption suites.

Learn more

CA1-005: CompTIA SecurityXDemo

AstroTutor

Notes

Readiness

QuestionQ35

Community Discussion