During a routine audit a web server is flagged for allowing the use of weak ciphers. Which of the following should be disabled to mitigate this risk? (Select TWO).

SSL 1.0 was Netscape's first draft of the SSL protocol and contained such severe cryptographic flaws that it was never publicly deployed - any server advertising support for it presents an unnecessary attack surface and should have it explicitly disabled.

RC4 is also a known weak stream cipher vulnerable to statistical attacks, but it was not selected as a correct answer in this question's context.

SSL 3.0 is vulnerable to the POODLE attack and is also considered insecure, but it was not among the two answers identified as correct here.

AES (Advanced Encryption Standard) is a strong, modern symmetric cipher approved by NIST and should remain enabled, not disabled.

DES (Data Encryption Standard) relies on a 56-bit key length, which modern hardware can brute force in hours. It has been formally retired and replaced by AES, and its presence in a server's cipher suite constitutes a critical vulnerability.

TLS 1.0 has known weaknesses (BEAST attack) and is generally discouraged, but it was not identified as one of the two correct answers in this question.