nerdexam
CompTIA

SY0-501 · Question #74

A network administrator is attempting to troubleshoot an issue regarding certificates on a secure website. During the troubleshooting process, the network administrator notices that the web gateway…

The correct answer is C. Man-in-the-middle. The scenario describes a web gateway proxy intercepting and re-signing all secure website certificates on local machines, which is a controlled implementation of a man-in-the-middle technique for purposes like SSL inspection or troubleshooting.

Submitted by eva_at· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

A network administrator is attempting to troubleshoot an issue regarding certificates on a secure website. During the troubleshooting process, the network administrator notices that the web gateway proxy on the local network has signed all of the certificates on the local machine. Which of the following describes the type of attack the proxy has been legitimately programmed to perform?

Options

  • ATransitive access
  • BSpoofing
  • CMan-in-the-middle
  • DReplay

How the community answered

(44 responses)
  • A
    14% (6)
  • B
    5% (2)
  • C
    80% (35)
  • D
    2% (1)

Why each option

The scenario describes a web gateway proxy intercepting and re-signing all secure website certificates on local machines, which is a controlled implementation of a man-in-the-middle technique for purposes like SSL inspection or troubleshooting.

ATransitive access

Transitive access refers to gaining unauthorized access to a system through an intermediary system that has legitimate access, which is not directly related to a proxy signing certificates for all local machines.

BSpoofing

Spoofing involves impersonating another entity to gain an advantage or access, and while the proxy is impersonating the website's certificate, the broader interception and relaying of all traffic define a man-in-the-middle attack.

CMan-in-the-middleCorrect

A man-in-the-middle (MitM) attack involves an intermediary intercepting, decrypting, re-encrypting, and relaying communication between two parties who believe they are communicating directly. In this case, the web gateway proxy acts as this intermediary, terminating the SSL/TLS connection, signing the certificates with its own trusted certificate, and then establishing a new connection to the destination, allowing it to inspect the encrypted traffic.

DReplay

A replay attack involves capturing and retransmitting data to trick a system into unauthorized actions, which is distinct from a proxy actively intercepting and re-signing certificates in real-time.

Concept tested: Man-in-the-middle (MitM) attacks and SSL/TLS interception

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/man-in-the-middle

Topics

#man-in-the-middle#SSL inspection#proxy#certificate management

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice