An engineer must prevent communication with a cloud application being decrypted. The application database uses AES-256 with SHA-512 and web access to the application uses HTTPS with SSLv2…

Question

Options

• ASSLV3 with self-signed certificates
• BTLS 1.3 with signed certificates
• CSSLv3 with signed certificates
• DTLS 1.3 with self-signed certificates

• A
  6% (3)
• B
  77% (37)
• C
  2% (1)
• D
  15% (7)

Explanation

Option B is correct because TLS 1.3 is the only current, non-deprecated transport security protocol that resists known decryption attacks, and CA-signed certificates provide a trusted identity chain that prevents man-in-the-middle attacks - both weaknesses are present in the current setup and must be fixed together.

Why the others fail:

• A (SSLv3, self-signed): SSLv3 is deprecated and vulnerable to the POODLE attack; self-signed certificates still allow MITM since no trusted CA validates the server's identity.
• C (SSLv3, signed): Proper certificates fix the trust problem but do nothing to protect against SSLv3's protocol-level vulnerabilities - an attacker can still force decryption.
• D (TLS 1.3, self-signed): TLS 1.3 is the right protocol, but self-signed certificates leave the authentication chain broken, allowing a rogue server to impersonate the application undetected.

Memory tip: Think of it as a lock and a keychain - TLS 1.3 is the strong lock (encryption), and a CA-signed certificate is the verified keychain (identity). You need both; a great lock on a door with no verified owner still lets anyone claim to be the landlord.

No community discussion yet for this question.