CAS-003 · Question #914
A developer is writing a new mobile application that employees will use to connect to an Internet- facing sensitive system. The security team is concerned with MITM attacks against the encrypted…
The correct answer is B. TLB 18 D. Certificate pinning. The threat is a Man-in-the-Middle (MITM) attack against encrypted traffic between a server and a mobile client. Two complementary controls address this: (1) TLS 1.3 (option B, misprinted as 'TLB 18') eliminates weak cipher suites and legacy handshake vulnerabilities present in…
Question
A developer is writing a new mobile application that employees will use to connect to an Internet- facing sensitive system. The security team is concerned with MITM attacks against the encrypted application traffic aimed at intercepting and decrypting sensitive information from the server to the mobile client. Which of the following should the developer implement to address the security team's concerns? (Select TWO).
Options
- AHSTS
- BTLB 18
- COCSP
- DCertificate pinning
- EKey stretching
How the community answered
(23 responses)- A17% (4)
- B74% (17)
- C4% (1)
- E4% (1)
Explanation
The threat is a Man-in-the-Middle (MITM) attack against encrypted traffic between a server and a mobile client. Two complementary controls address this: (1) TLS 1.3 (option B, misprinted as 'TLB 18') eliminates weak cipher suites and legacy handshake vulnerabilities present in older TLS versions, making the encrypted channel itself harder to break or downgrade. (2) Certificate pinning (option D) instructs the mobile app to only trust a specific certificate or public key for the server, so even if an attacker presents a certificate signed by a trusted CA (a classic MITM technique), the app will reject it and refuse to connect. HSTS (A) is a browser-centric HTTP header that enforces HTTPS on web clients but is not applicable to mobile app SDK-level connections. OCSP (C) checks certificate revocation status but does not prevent MITM. Key stretching (E) strengthens password hashing and has no role in transport-layer MITM defense.
Topics
Community Discussion
No community discussion yet for this question.