Multiple Choice
A security analyst for a bank received an anonymous tip on the external banking website showing the following: Protocols supported - TLS 1.0 - SSL 3 - SSL 2 Cipher suites supported - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA-ECDH p256r1 - TLS_DHE_RSA_WITH_AES_256_CBC_SHA-DH 1024bit - TLS_RSA_WITH_RC4_128_SHA TLS_FALLBACK_SCSV non supported POODLE Weak PFS OCSP stapling supported Which of the following should the analyst use to reproduce these findings comprehensively?
A) Query the OCSP responder and review revocation information for the user certificates.
B) Review CA-supported ciphers and inspect the connection through an HTTP proxy.
C) Perform a POODLE (SSLv3) attack using an exploitations framework and inspect the output.
D) Inspect the server certificate and simulate SSL/TLS handshakes for enumeration.
Correct Answer:
Verified
Correct Answer:
Verified
Q26: An advanced threat emulation engineer is conducting
Q27: A company that has been breached multiple
Q28: A security engineer is assisting a developer
Q29: A recent assessment identified that several users'
Q30: A system owner has requested support from
Q32: A company has decided to lower costs
Q33: A security analyst is inspecting pseudocode of
Q34: The code snippet below controls all electronic
Q35: An agency has implemented a data retention
Q36: The Chief Financial Officer (CFO) of an