A penetration tester is assessing a mobile banking application. Man-in-the-middle attempts via a HTTP intercepting proxy are failing with SSL errors. Which of the following controls has likely been…

Certificate revocation checks whether a certificate has been invalidated by the CA; it does not reject certificates from other CAs and would not cause proxy interception to fail with SSL errors.

Certificate pinning embeds the expected server certificate or public key hash directly in the mobile application at build time. When a MITM proxy intercepts the connection and presents its own certificate, the app detects the mismatch against the pinned value and aborts the TLS handshake, producing the SSL errors observed by the tester.

Rootkit detection identifies device-level compromise and would not interfere with TLS certificate validation during a proxy interception attempt.

Extended Validation certificates provide enhanced identity validation for the domain owner but do not pin any certificate to the application and would not block a MITM proxy.