A network security administrator is worried about potential man-in-the-middle attacks when users access a corporate web site from their workstations. Which of the following is the best remediation…

Question

Options

• AImplementing server-side PKI certificates for all connections
• BMandating only client-side PKI certificates for all connections
• CRequiring client and server PKI certificates for all connections
• DRequiring strong authentication for all DNS queries

• A
  6% (3)
• B
  4% (2)
• C
  78% (40)
• D
  12% (6)

Explanation

Requiring both client-side and server-side PKI certificates - known as mutual TLS (mTLS) - is the strongest defense against man-in-the-middle (MITM) attacks. In a MITM scenario, an attacker intercepts communication between a client and server, potentially impersonating one or both parties. With mutual authentication, the server proves its identity to the client AND the client proves its identity to the server, so an attacker cannot successfully impersonate either endpoint without a valid, trusted certificate. Option A (server-only certificates) is the standard HTTPS model and only authenticates the server, leaving the client unverified. Option B (client-only certificates) authenticates the client but not the server, still leaving room for a rogue server. Option D (strong DNS authentication, such as DNSSEC) helps prevent DNS spoofing but does not fully protect the TLS layer from MITM attacks.

No community discussion yet for this question.