nerdexam
(ISC)2

301B · Question #18

Given this as the first packet displayed of an ssldump: 2 2 1296947622.6313 (0.0001) S>CV3.1(74) Handshake ServerHello Version 3.1 random[32]= 19 31 e7 35 c1 14 65 63 54 23 b7 c4 30 a2 f0 b8 c4 20 06

The correct answer is C. The data is contained within a resumed TLS session.. See the full explanation below for the reasoning.

Question

Given this as the first packet displayed of an ssldump: 2 2 1296947622.6313 (0.0001) S>CV3.1(74) Handshake ServerHello Version 3.1 random[32]= 19 31 e7 35 c1 14 65 63 54 23 b7 c4 30 a2 f0 b8 c4 20 06 86 ed 9c 1f 9e 46 0f 42 79 45 8a 29 session_id[32]= c4 44 ea 86 e2 ba f5 40 4b 44 b4 c2 3a d8 b4 ad 4c dc 13 0d 6c 48 f2 70 19 c3 05 f4 06 e5 ab a9 ciphersuite TLS_RSA_WITH_RC4_128_SHA compressionMethod NULL In reviewing the test of the ssldump, the application data is NOT being decrypted. Why is ssldump failing to decrypt the application data?

Options

  • AThe application data is encrypted with SSLv3.
  • BThe application data is encrypted with TLSv1.
  • CThe data is contained within a resumed TLS session.
  • DThe BigDB Key Log Tcpdump.Level needs to be adjusted.

How the community answered

(39 responses)
  • A
    15% (6)
  • B
    3% (1)
  • C
    74% (29)
  • D
    8% (3)

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 301B Practice