Examkin

Question

Difficulty: MediumHost, Network, and Architecture Vulnerabilities

A security analyst reviews a vulnerability scan report for an internal web application server. The scan output displays the following finding:

text
Host: 192.168.10.45:443
Plugin Name: TLS/SSL Server Supports Weak Cipher Suites / Legacy Protocols
Risk Factor: High
Description: The remote service accepts TLS 1.0 and SSL 3.0 protocol negotiations using CBC-mode ciphers.

Which of the following host and infrastructure vulnerabilities is directly identified by this report?

  1. Implementation of outdated cryptographic protocols and weak encryption ciphersAnswer
  2. B
    Over-reliance on internal network perimeter boundaries without continuous endpoint verification
  3. C
    Unsanitized user input handling in the web application leading to database command execution
  4. D
    Misconfigured stateless network firewall rules allowing unauthorized port traffic

Answer

Implementation of outdated cryptographic protocols and weak encryption ciphers
The correct answer identifies the underlying flaw: using deprecated protocols (SSL 3.0 and TLS 1.0) and cipher suites. These legacy standards lack modern cipher safeguards and expose transport security to downgrade and man-in-the-middle exploits. Remediating this host vulnerability requires configuring the web server to enforce TLS 1.2 or TLS 1.3 with secure cipher suites.

Step-by-Step Solution

1
Analyze the vulnerability scanner output snippet.
Identified port 443 active services accepting SSL 3.0 and TLS 1.0 connections with CBC ciphers.
Vulnerability scanners flag legacy SSL/TLS versions due to well-known protocol design flaws and cryptographic weaknesses.
2
Evaluate the underlying vulnerability category.
The issue is a host infrastructure configuration flaw regarding supported cryptographic algorithms and protocols.
Host security hardening requires disabling deprecated protocols (SSL 3.0, TLS 1.0, TLS 1.1) and enabling modern protocols (TLS 1.2, TLS 1.3).

Key Concept

Host and Infrastructure Cryptographic Vulnerabilities
Estimated Time:1m 15s
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities