SY0-501 · Question #74
A network administrator is attempting to troubleshoot an issue regarding certificates on a secure website. During the troubleshooting process, the network administrator notices that the web gateway…
The correct answer is C. Man-in-the-middle. The scenario describes a web gateway proxy intercepting and re-signing all secure website certificates on local machines, which is a controlled implementation of a man-in-the-middle technique for purposes like SSL inspection or troubleshooting.
Question
A network administrator is attempting to troubleshoot an issue regarding certificates on a secure website. During the troubleshooting process, the network administrator notices that the web gateway proxy on the local network has signed all of the certificates on the local machine. Which of the following describes the type of attack the proxy has been legitimately programmed to perform?
Options
- ATransitive access
- BSpoofing
- CMan-in-the-middle
- DReplay
How the community answered
(44 responses)- A14% (6)
- B5% (2)
- C80% (35)
- D2% (1)
Why each option
The scenario describes a web gateway proxy intercepting and re-signing all secure website certificates on local machines, which is a controlled implementation of a man-in-the-middle technique for purposes like SSL inspection or troubleshooting.
Transitive access refers to gaining unauthorized access to a system through an intermediary system that has legitimate access, which is not directly related to a proxy signing certificates for all local machines.
Spoofing involves impersonating another entity to gain an advantage or access, and while the proxy is impersonating the website's certificate, the broader interception and relaying of all traffic define a man-in-the-middle attack.
A man-in-the-middle (MitM) attack involves an intermediary intercepting, decrypting, re-encrypting, and relaying communication between two parties who believe they are communicating directly. In this case, the web gateway proxy acts as this intermediary, terminating the SSL/TLS connection, signing the certificates with its own trusted certificate, and then establishing a new connection to the destination, allowing it to inspect the encrypted traffic.
A replay attack involves capturing and retransmitting data to trick a system into unauthorized actions, which is distinct from a proxy actively intercepting and re-signing certificates in real-time.
Concept tested: Man-in-the-middle (MitM) attacks and SSL/TLS interception
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/man-in-the-middle
Topics
Community Discussion
No community discussion yet for this question.