A security analyst is reviewing the logs from a NIDS. the analyst notices the following in quick succession between a client and a web server. Which of the following describes what MOST likely…

Question

Exhibit

Options

• AA protocol downgrade attack which can be mitigated by disabling server and client support for
• BA MITM SSL stripping attack which can be mitigated by enabling HSTS on the web server
• CA broadcast RC4 attack which can be mitigated by disabling cipher suites permitting the use of
• DAn attack on TLS compression revealing cipher text which can be mitigated by implementing a

• A
  65% (22)
• B
  12% (4)
• C
  6% (2)
• D
  18% (6)

Explanation

The NIDS log pattern showing a rapid sequence of connection attempts with varying protocol versions between a client and web server is characteristic of a protocol downgrade attack. In this attack type, an adversary manipulates the TLS/SSL handshake to force both parties to negotiate an older, weaker protocol version (such as SSLv3 or TLS 1.0) that contains known vulnerabilities (e.g., POODLE, DROWN). The mitigation is to disable support for deprecated protocol versions on both the server and client so a downgrade cannot be negotiated. Option B (HSTS/SSL stripping) would show HTTP vs HTTPS traffic patterns, not version negotiation sequences. Option C (RC4) would not appear as a sequential connection pattern. Option D (TLS compression/CRIME attack) is a compression-level attack, not a version negotiation pattern.

No community discussion yet for this question.