CAS-005 · Question #192
A security engineer is reviewing the results of an annual penetration test. The report lists one of the results as "critical severity" on several domain-joined workstations: SSL/TLS Weak Protocols…
The correct answer is B. A GPO to disable weak protocols in the Schannel hive. A Group Policy Object (GPO) is the most centralized and scalable way to implement this change across multiple domain-joined workstations. By configuring a GPO to disable weak protocols (TLS 1.0 and TLS 1.1) in the Schannel hive, the security engineer can ensure consistent…
Question
A security engineer is reviewing the results of an annual penetration test. The report lists one of the results as "critical severity" on several domain-joined workstations:
SSL/TLS Weak Protocols Supported TLS 1.0, TLS 1.1 Which of the following should the security engineer implement to remediate this finding in the most centralized manner?
Options
- AAn SCCM patch to disable weak protocols in the Schannel hive
- BA GPO to disable weak protocols in the Schannel hive
- CA PowerShell script to disable weak protocols in the HKLM Schannel hive
- DA registry script to disable weak protocols in the Schannel hive
How the community answered
(56 responses)- A2% (1)
- B82% (46)
- C5% (3)
- D11% (6)
Explanation
A Group Policy Object (GPO) is the most centralized and scalable way to implement this change across multiple domain-joined workstations. By configuring a GPO to disable weak protocols (TLS 1.0 and TLS 1.1) in the Schannel hive, the security engineer can ensure consistent enforcement across all affected systems in the domain without needing to manually configure each machine individually.
Community Discussion
No community discussion yet for this question.