Insufficient Transport Layer Security – Insecure HTTPS – MCQ Questions

1. What is the primary purpose of Transport Layer Security (TLS)?

A) Encrypting stored data
B) Securing network communication
C) Preventing SQL Injection
D) Hiding IP addresses

✅ Answer: B) Securing network communication
Explanation: TLS ensures secure communication by encrypting data transmitted over the internet, preventing eavesdropping and man-in-the-middle attacks.

---

2. Which version of TLS is considered insecure and should NOT be used?

A) TLS 1.2
B) TLS 1.3
C) TLS 1.1
D) All TLS versions are secure

✅ Answer: C) TLS 1.1
Explanation: TLS 1.1 and older versions are deprecated due to security vulnerabilities. TLS 1.2 and 1.3 are the recommended versions.

---

3. What is a major vulnerability of using HTTP instead of HTTPS?

A) Increased website loading time
B) Exposure to Man-in-the-Middle (MITM) attacks
C) Reduced browser compatibility
D) Server performance issues

✅ Answer: B) Exposure to Man-in-the-Middle (MITM) attacks
Explanation: HTTP transmits data in plain text, making it vulnerable to MITM attacks, where attackers can intercept and manipulate data.

---

4. Which protocol does HTTPS rely on to encrypt communications?

A) Secure File Transfer Protocol (SFTP)
B) Transport Layer Security (TLS)
C) Simple Mail Transfer Protocol (SMTP)
D) Secure Hypertext Markup Language (SHTML)

✅ Answer: B) Transport Layer Security (TLS)
Explanation: HTTPS (Hypertext Transfer Protocol Secure) uses TLS to encrypt communication between a web server and a browser.

---

5. What is the role of a digital certificate in HTTPS?

A) It prevents cross-site scripting (XSS)
B) It encrypts the website’s database
C) It verifies the identity of the website and encrypts the connection
D) It speeds up website loading time

✅ Answer: C) It verifies the identity of the website and encrypts the connection
Explanation: Digital certificates, issued by Certificate Authorities (CAs), authenticate websites and enable secure HTTPS connections.

---

6. Which of the following is NOT a valid TLS cipher suite?

A) TLS_AES_128_GCM_SHA256
B) TLS_RSA_WITH_AES_128_CBC_SHA
C) TLS_DHE_RSA_WITH_DES_CBC_SHA
D) TLS_Quantum_Encrypt_256_SHA

✅ Answer: D) TLS_Quantum_Encrypt_256_SHA
Explanation: The listed cipher suites exist except for TLS_Quantum_Encrypt_256_SHA, which is not a valid TLS cipher.

---

7. What does HSTS (HTTP Strict Transport Security) do?

A) Forces browsers to only use HTTPS connections
B) Prevents SQL Injection
C) Blocks JavaScript execution on a webpage
D) Encrypts website cookies

✅ Answer: A) Forces browsers to only use HTTPS connections
Explanation: HSTS forces browsers to always use HTTPS, protecting against SSL stripping attacks.

---

8. Why is TLS 1.3 more secure than previous versions?

A) It removes outdated cryptographic algorithms
B) It uses faster encryption techniques
C) It eliminates support for RSA key exchange
D) All of the above

✅ Answer: D) All of the above
Explanation: TLS 1.3 improves security by removing weak cryptographic algorithms, enhancing performance, and enforcing stronger encryption methods.

---

9. What happens when a website’s SSL/TLS certificate expires?

A) The website automatically switches to HTTP
B) Users see a security warning in their browser
C) The website remains secure but is slightly slower
D) The website becomes completely inaccessible

✅ Answer: B) Users see a security warning in their browser
Explanation: Browsers warn users when an expired SSL/TLS certificate is detected, indicating a potential security risk.

---

10. What is an SSL/TLS certificate issued by a trusted Certificate Authority (CA) used for?

A) To hide the website’s IP address
B) To verify the website’s identity and encrypt data
C) To boost search engine rankings
D) To prevent JavaScript-based attacks

✅ Answer: B) To verify the website’s identity and encrypt data
Explanation: SSL/TLS certificates ensure website authenticity and establish a secure connection with users.

---

11. What is the primary purpose of Perfect Forward Secrecy (PFS)?

A) To allow session persistence across multiple devices
B) To ensure past communications remain secure even if private keys are compromised
C) To improve website speed
D) To replace TLS entirely

✅ Answer: B) To ensure past communications remain secure even if private keys are compromised
Explanation: PFS ensures that previous encrypted communications cannot be decrypted even if the private key is later compromised.

---

12. Which attack is prevented by using HTTPS?

A) SQL Injection
B) Cross-Site Scripting (XSS)
C) Man-in-the-Middle (MITM) attack
D) Brute-force attack

✅ Answer: C) Man-in-the-Middle (MITM) attack
Explanation: HTTPS prevents MITM attacks by encrypting data during transmission, making it unreadable to attackers.

---

13. Which type of SSL/TLS certificate provides the highest level of validation?

A) Domain Validation (DV)
B) Organization Validation (OV)
C) Extended Validation (EV)
D) Self-signed certificate

✅ Answer: C) Extended Validation (EV)
Explanation: EV certificates offer the highest level of trust by verifying the organization behind the website.

---

14. What does an attacker achieve with an SSL stripping attack?

A) Forces a website to downgrade from HTTPS to HTTP
B) Extracts private keys from a web server
C) Manipulates TLS certificates
D) Executes malicious JavaScript

✅ Answer: A) Forces a website to downgrade from HTTPS to HTTP
Explanation: SSL stripping downgrades HTTPS connections to HTTP, making communication unencrypted and vulnerable to interception.

---

15. What is a self-signed SSL/TLS certificate?

A) A certificate issued by a trusted CA
B) A certificate generated and signed by a website owner
C) A certificate that never expires
D) A certificate used only for email encryption

✅ Answer: B) A certificate generated and signed by a website owner
Explanation: Self-signed certificates are not trusted by browsers as they lack third-party validation.

---

16. How does Certificate Pinning enhance HTTPS security?

A) It ensures the browser only trusts specific pre-configured certificates
B) It allows faster TLS handshakes
C) It prevents brute-force attacks
D) It encrypts JavaScript files

✅ Answer: A) It ensures the browser only trusts specific pre-configured certificates
Explanation: Certificate Pinning helps prevent MITM attacks by allowing only trusted certificates for a domain.

---

17. Which attack exploits vulnerabilities in TLS renegotiation?

A) POODLE attack
B) BEAST attack
C) Triple Handshake attack
D) Heartbleed attack

✅ Answer: C) Triple Handshake attack
Explanation: The Triple Handshake attack exploits weaknesses in TLS renegotiation, allowing session hijacking.

---

18. What should a website owner do if their SSL certificate is revoked?

A) Switch to HTTP
B) Obtain a new certificate from a trusted CA
C) Disable HTTPS temporarily
D) Ignore the warning

✅ Answer: B) Obtain a new certificate from a trusted CA
Explanation: A revoked certificate is untrusted; replacing it ensures secure HTTPS connections.

---

19. What does TLS handshake establish?

A) An encrypted communication session between client and server
B) A database connection
C) A firewall rule for secure access
D) A VPN tunnel

✅ Answer: A) An encrypted communication session between client and server
Explanation: The TLS handshake establishes an encrypted session, verifying both the server and (optionally) the client.

---

20. What does OCSP (Online Certificate Status Protocol) check for?

A) If a website has expired content
B) If a TLS certificate is revoked
C) If a website uses HTTPS
D) If an IP address is blacklisted

✅ Answer: B) If a TLS certificate is revoked
Explanation: OCSP allows browsers to check if an SSL/TLS certificate is still valid or has been revoked.

---

21. What is the primary function of Certificate Transparency (CT)?

A) It ensures certificates are issued correctly and publicly logged
B) It encrypts TLS communication
C) It replaces TLS with a stronger encryption method
D) It prevents phishing attacks

✅ Answer: A) It ensures certificates are issued correctly and publicly logged
Explanation: Certificate Transparency helps detect misissued or fraudulent SSL/TLS certificates.

---

22. Why is TLS session resumption used?

A) To enhance encryption strength
B) To reduce the overhead of repeated TLS handshakes
C) To increase latency in secure communications
D) To automatically renew expired certificates

✅ Answer: B) To reduce the overhead of repeated TLS handshakes
Explanation: TLS session resumption speeds up HTTPS connections by reusing previous handshake data.

---

23. What is a TLS downgrade attack?

A) An attack that forces TLS to fall back to an insecure version
B) A method for upgrading TLS security
C) A way to renew expired certificates
D) A vulnerability that only affects self-signed certificates

✅ Answer: A) An attack that forces TLS to fall back to an insecure version
Explanation: Downgrade attacks (e.g., POODLE) force clients to use weaker encryption protocols, making communication vulnerable.

---

24. Why is disabling TLS 1.0 and TLS 1.1 recommended?

A) They have known security vulnerabilities
B) They slow down HTTPS traffic
C) They cause TLS handshake failures
D) They are not compatible with IPv6

✅ Answer: A) They have known security vulnerabilities
Explanation: TLS 1.0 and 1.1 are deprecated due to vulnerabilities that make them susceptible to attacks like BEAST.

---

25. What is the role of a root certificate in HTTPS?

A) It acts as the foundation of trust in the certificate hierarchy
B) It encrypts web pages
C) It speeds up TLS handshakes
D) It replaces expired certificates

✅ Answer: A) It acts as the foundation of trust in the certificate hierarchy
Explanation: Root certificates, issued by Certificate Authorities (CAs), verify other certificates in a trust chain.

---

26. What is an Extended Validation (EV) SSL certificate?

A) A certificate with stronger encryption
B) A certificate with enhanced identity verification for businesses
C) A self-signed certificate
D) A free SSL certificate

✅ Answer: B) A certificate with enhanced identity verification for businesses
Explanation: EV certificates require stricter validation processes, increasing user trust.

---

27. What is the impact of using weak cipher suites in TLS?

A) It makes encryption stronger
B) It increases the risk of cryptographic attacks
C) It improves website performance
D) It disables HTTPS

✅ Answer: B) It increases the risk of cryptographic attacks
Explanation: Weak cipher suites allow attackers to exploit vulnerabilities and decrypt communications.

---

28. What is a wildcard SSL certificate?

A) A certificate used for a single domain
B) A certificate that secures multiple subdomains
C) A self-signed certificate
D) A certificate that never expires

✅ Answer: B) A certificate that secures multiple subdomains
Explanation: Wildcard SSL certificates secure a domain and all its subdomains, reducing the need for separate certificates.

---

29. How does an attacker exploit a misconfigured TLS setup?

A) By modifying the HTTP request headers
B) By launching a Man-in-the-Middle (MITM) attack
C) By injecting malicious JavaScript
D) By sending phishing emails

✅ Answer: B) By launching a Man-in-the-Middle (MITM) attack
Explanation: Insecure TLS configurations can allow attackers to intercept and modify encrypted communications.

---

30. Which header helps enforce HTTPS connections?

A) Content-Security-Policy
B) Strict-Transport-Security
C) Referrer-Policy
D) X-Frame-Options

✅ Answer: B) Strict-Transport-Security
Explanation: The Strict-Transport-Security (HSTS) header forces browsers to use HTTPS, preventing SSL stripping attacks.

---

31. Why should TLS certificates be renewed before expiration?

A) Expired certificates trigger security warnings in browsers
B) They stop HTTP-to-HTTPS redirects
C) They slow down website performance
D) They prevent JavaScript attacks

✅ Answer: A) Expired certificates trigger security warnings in browsers
Explanation: Expired certificates make websites appear untrustworthy, potentially leading to loss of traffic and security risks.

---

32. How does a TLS record protocol enhance security?

A) By preventing TLS downgrade attacks
B) By encapsulating encrypted data for secure transmission
C) By handling public key exchange
D) By replacing HTTP with HTTPS

✅ Answer: B) By encapsulating encrypted data for secure transmission
Explanation: The TLS record protocol ensures the confidentiality and integrity of transmitted data.

---

33. What is a TLS renegotiation attack?

A) A method for refreshing expired certificates
B) An attack exploiting TLS session renegotiation to inject malicious data
C) A brute-force attack on encrypted traffic
D) A way to force a website to use HTTPS

✅ Answer: B) An attack exploiting TLS session renegotiation to inject malicious data
Explanation: TLS renegotiation vulnerabilities allow attackers to inject unverified data into encrypted sessions.

---

34. Why is self-signed SSL/TLS not recommended for production websites?

A) They cost more than CA-issued certificates
B) They are not trusted by browsers
C) They use outdated encryption algorithms
D) They cause websites to load slowly

✅ Answer: B) They are not trusted by browsers
Explanation: Self-signed certificates lack third-party validation and trigger security warnings in browsers.

---

35. Which TLS feature prevents replay attacks?

A) Certificate Transparency
B) Session Tickets
C) Ephemeral Key Exchange
D) OCSP

✅ Answer: C) Ephemeral Key Exchange
Explanation: Ephemeral key exchange generates unique session keys, preventing attackers from reusing intercepted data.

---

36. Why is TLS inspection used in enterprise networks?

A) To decrypt and analyze HTTPS traffic for security threats
B) To speed up web browsing
C) To block HTTPS connections
D) To remove expired certificates

✅ Answer: A) To decrypt and analyze HTTPS traffic for security threats
Explanation: TLS inspection allows security tools to detect threats hidden in encrypted HTTPS traffic.

---

37. What does a Let’s Encrypt SSL certificate provide?

A) Free SSL certificates for websites
B) Lifetime SSL certificates
C) The highest level of encryption
D) A replacement for TLS

✅ Answer: A) Free SSL certificates for websites
Explanation: Let’s Encrypt provides free SSL certificates to encourage widespread HTTPS adoption.

---

38. What is the impact of an expired TLS certificate on a website?

A) The website loads faster
B) Browsers display a security warning
C) The website automatically switches to HTTP
D) The website remains secure but loses encryption

✅ Answer: B) Browsers display a security warning
Explanation: Expired TLS certificates cause browsers to warn users about potential security risks, making visitors hesitant to proceed.

---

39. What is the purpose of the TLS Alert Protocol?

A) It alerts administrators about certificate expiration
B) It notifies users when a site is using HTTPS
C) It manages TLS error messages and session termination
D) It forces websites to use stronger encryption

✅ Answer: C) It manages TLS error messages and session termination
Explanation: The TLS Alert Protocol is used to notify clients and servers of TLS errors or security issues, often leading to session termination.

---

40. What does a cipher suite in TLS define?

A) The combination of encryption algorithms used in TLS communication
B) The domain names allowed in a TLS certificate
C) The duration of a TLS session
D) The number of users who can connect to a secure server

✅ Answer: A) The combination of encryption algorithms used in TLS communication
Explanation: Cipher suites define encryption, authentication, key exchange, and integrity protection methods in TLS.

---

41. What is a TLS fallback attack?

A) An attack that forces a client to use an older, weaker TLS version
B) A technique for strengthening encryption
C) A security feature in TLS 1.3
D) A method for quickly restoring lost HTTPS connections

✅ Answer: A) An attack that forces a client to use an older, weaker TLS version
Explanation: TLS fallback attacks downgrade secure connections to weaker versions, making them vulnerable to exploits like POODLE.

---

42. How does a TLS downgrade protection mechanism work?

A) It blocks connections using outdated TLS versions
B) It enforces HSTS headers
C) It encrypts all traffic with a new encryption key
D) It prevents brute-force attacks on HTTPS

✅ Answer: A) It blocks connections using outdated TLS versions
Explanation: TLS downgrade protection ensures that clients and servers reject weak encryption versions, mitigating downgrade attacks.

---

43. What is the impact of using an RSA key exchange in TLS?

A) It enhances security by making key exchanges faster
B) It allows forward secrecy
C) It does not provide forward secrecy, making past sessions vulnerable
D) It eliminates the need for certificates

✅ Answer: C) It does not provide forward secrecy, making past sessions vulnerable
Explanation: RSA key exchange lacks forward secrecy, meaning past encrypted communications can be decrypted if the private key is compromised.

---

44. Why is TLS session caching used?

A) To improve TLS handshake performance
B) To store TLS certificates for faster validation
C) To allow browsers to remember passwords
D) To block TLS downgrade attacks

✅ Answer: A) To improve TLS handshake performance
Explanation: TLS session caching reduces handshake times by reusing previously established secure connections.

---

45. What is the primary purpose of an Extended Master Secret (EMS) in TLS?

A) To allow TLS handshakes to be reused
B) To protect against TLS renegotiation attacks
C) To prevent session hijacking attacks
D) To provide stronger encryption algorithms

✅ Answer: B) To protect against TLS renegotiation attacks
Explanation: EMS strengthens TLS session integrity by ensuring that master secrets are unique for each session.

---

46. What does ALPN (Application-Layer Protocol Negotiation) in TLS do?

A) It selects the most efficient encryption algorithm
B) It allows clients and servers to negotiate the protocol to use over a TLS connection
C) It forces websites to use HTTPS
D) It prevents TLS downgrade attacks

✅ Answer: B) It allows clients and servers to negotiate the protocol to use over a TLS connection
Explanation: ALPN enables applications like HTTP/2 and QUIC to negotiate their preferred protocols over a TLS session.

---

47. What type of attack exploits weak randomness in TLS session keys?

A) POODLE attack
B) ROCA attack
C) Birthday attack
D) Lucky Thirteen attack

✅ Answer: D) Lucky Thirteen attack
Explanation: The Lucky Thirteen attack exploits weaknesses in CBC mode cipher suites in older versions of TLS.

---

48. How does a TLS Man-in-the-Middle (MITM) attack occur?

A) By exploiting TLS session resumption
B) By intercepting and decrypting unprotected TLS connections
C) By modifying browser security headers
D) By blocking HTTPS traffic

✅ Answer: B) By intercepting and decrypting unprotected TLS connections
Explanation: Attackers in a MITM attack intercept and manipulate HTTPS traffic if weak encryption or certificate misconfigurations exist.

---

49. What is the impact of using weak Diffie-Hellman key exchange parameters in TLS?

A) It makes TLS handshakes faster
B) It allows attackers to break encryption using precomputed keys
C) It improves HTTPS website performance
D) It enables Certificate Transparency

✅ Answer: B) It allows attackers to break encryption using precomputed keys
Explanation: Weak Diffie-Hellman parameters (such as those used in the Logjam attack) allow attackers to decrypt HTTPS traffic.

---

50. How can an attacker perform an SSL/TLS stripping attack?

A) By forcing a browser to establish an HTTP connection instead of HTTPS
B) By encrypting all HTTP requests
C) By injecting malicious certificates
D) By modifying HTTP headers to force TLS 1.3

✅ Answer: A) By forcing a browser to establish an HTTP connection instead of HTTPS
Explanation: SSL stripping downgrades HTTPS connections to HTTP, exposing data to attackers.

---

51. How does a website indicate that it enforces HTTPS in all communications?

A) By using HSTS headers
B) By enabling TLS compression
C) By using a wildcard SSL certificate
D) By enforcing DNSSEC

✅ Answer: A) By using HSTS headers
Explanation: HTTP Strict Transport Security (HSTS) ensures all connections to a site use HTTPS.

---

52. What is the main security concern with TLS compression?

A) It weakens encryption
B) It enables CRIME attacks that leak encrypted data
C) It prevents certificate expiration
D) It causes slower website loading

✅ Answer: B) It enables CRIME attacks that leak encrypted data
Explanation: TLS compression can leak sensitive information by allowing attackers to infer plaintext from compressed ciphertext.

---

53. How does DNS over HTTPS (DoH) improve security?

A) It encrypts DNS queries to prevent eavesdropping
B) It replaces HTTPS encryption
C) It blocks TLS downgrade attacks
D) It forces all websites to use HTTPS

✅ Answer: A) It encrypts DNS queries to prevent eavesdropping
Explanation: DoH secures DNS traffic by encrypting queries, preventing attackers from monitoring a user’s browsing activity.

---

54. What is a TLS MITM proxy used for in security monitoring?

A) To inspect encrypted HTTPS traffic for threats
B) To replace SSL certificates
C) To prevent TLS session hijacking
D) To speed up HTTP traffic

✅ Answer: A) To inspect encrypted HTTPS traffic for threats
Explanation: TLS MITM proxies are used in enterprise networks for deep packet inspection.

---

55. What does Forward Secrecy (FS) protect against?

A) TLS session hijacking
B) Decryption of past communications if private keys are compromised
C) Certificate expiration
D) DNS spoofing

✅ Answer: B) Decryption of past communications if private keys are compromised
Explanation: Forward Secrecy ensures that compromised keys cannot be used to decrypt past TLS sessions.

---

56. What does the term “TLS Perfect Forward Secrecy” refer to?

A) Preventing future TLS updates from breaking compatibility
B) Ensuring that past communications remain secure even if private keys are compromised
C) Eliminating the need for public-key cryptography
D) Encrypting TLS certificates permanently

✅ Answer: B) Ensuring that past communications remain secure even if private keys are compromised
Explanation: Perfect Forward Secrecy (PFS) ensures that each TLS session generates a unique key, preventing decryption of previous sessions if a private key is leaked.

---

57. Why are wildcard SSL certificates used?

A) To secure multiple subdomains under a single certificate
B) To encrypt DNS queries
C) To speed up TLS handshakes
D) To eliminate the need for HSTS

✅ Answer: A) To secure multiple subdomains under a single certificate
Explanation: Wildcard SSL certificates allow a domain and all its subdomains (e.g., *.example.com) to be secured with one certificate.

---

58. How does Certificate Transparency (CT) enhance security?

A) It logs SSL/TLS certificates in a public ledger to detect misissuance
B) It prevents TLS downgrade attacks
C) It forces websites to use HTTPS
D) It replaces the need for TLS certificates

✅ Answer: A) It logs SSL/TLS certificates in a public ledger to detect misissuance
Explanation: CT helps prevent fraudulently issued certificates by making all issued certificates publicly verifiable.

---

59. What is the main reason organizations implement TLS inspection?

A) To detect threats hidden in encrypted traffic
B) To disable HTTPS for better speed
C) To enforce wildcard certificates
D) To block access to HTTP-only sites

✅ Answer: A) To detect threats hidden in encrypted traffic
Explanation: TLS inspection (also called SSL decryption) is used to monitor encrypted HTTPS traffic for malware, phishing, and data exfiltration.

---

60. What does a TLS certificate revocation list (CRL) do?

A) Prevents expired certificates from being reused
B) Lists revoked SSL/TLS certificates to prevent their use
C) Forces websites to use HTTPS
D) Encrypts SSL certificates for added security

✅ Answer: B) Lists revoked SSL/TLS certificates to prevent their use
Explanation: CRLs contain certificates that have been revoked due to compromise or other security reasons.

---

61. Why is TLS 1.3 preferred over TLS 1.2?

A) It eliminates outdated cryptographic algorithms
B) It speeds up handshake performance
C) It provides stronger encryption
D) All of the above

✅ Answer: D) All of the above
Explanation: TLS 1.3 removes weak algorithms, improves security, and reduces latency in encrypted communication.

---

62. What is a root certificate authority (CA)?

A) The highest level of trust in SSL/TLS certificate chains
B) A self-signed certificate used for local encryption
C) A CA that only issues wildcard certificates
D) A security feature in HTTPS headers

✅ Answer: A) The highest level of trust in SSL/TLS certificate chains
Explanation: Root CAs are at the top of the certificate trust hierarchy and issue trusted digital certificates.

---

63. What is a self-signed certificate?

A) A certificate issued by a trusted CA
B) A certificate signed by the organization that owns it
C) A certificate that never expires
D) A special certificate used for DNS encryption

✅ Answer: B) A certificate signed by the organization that owns it
Explanation: Self-signed certificates are not trusted by browsers because they lack third-party verification.

---

64. What does an attacker achieve with a TLS BEAST attack?

A) Forces a downgrade to SSL 3.0
B) Exploits TLS 1.0 CBC mode encryption vulnerabilities
C) Breaks forward secrecy in TLS 1.3
D) Steals encryption keys using quantum computing

✅ Answer: B) Exploits TLS 1.0 CBC mode encryption vulnerabilities
Explanation: The BEAST attack targets TLS 1.0’s CBC encryption mode, making it vulnerable to ciphertext guessing.

---

65. Why is using a strong TLS cipher suite important?

A) It prevents brute-force attacks on encrypted data
B) It increases website speed
C) It reduces the need for TLS inspection
D) It eliminates the need for DNSSEC

✅ Answer: A) It prevents brute-force attacks on encrypted data
Explanation: Strong cipher suites provide robust encryption, making it harder for attackers to decrypt data.

---

66. Why should websites use HTTPS instead of HTTP?

A) To prevent data interception by attackers
B) To improve search engine rankings
C) To build user trust
D) All of the above

✅ Answer: D) All of the above
Explanation: HTTPS secures data in transit, improves SEO rankings, and enhances user confidence in website security.

---

67. What attack exploits weak or misconfigured HTTPS settings?

A) SQL Injection
B) Cross-Site Scripting (XSS)
C) Man-in-the-Middle (MITM) attacks
D) Buffer Overflow

✅ Answer: C) Man-in-the-Middle (MITM) attacks
Explanation: Insecure TLS settings make websites vulnerable to MITM attacks, where attackers intercept and manipulate traffic.

---

68. What does TLS Strict Transport Security (HSTS) prevent?

A) Forced HTTPS downgrades
B) Brute-force attacks
C) Cross-site scripting
D) Email phishing

✅ Answer: A) Forced HTTPS downgrades
Explanation: HSTS forces browsers to use HTTPS, protecting against SSL stripping attacks.

---

69. Why should TLS private keys never be stored on public servers?

A) They can be stolen and used to decrypt traffic
B) They increase website load times
C) They interfere with DNS resolution
D) They prevent HTTPS from working

✅ Answer: A) They can be stolen and used to decrypt traffic
Explanation: Private keys must remain secure to prevent attackers from decrypting encrypted communications.

---

70. Why should outdated TLS versions be disabled on a web server?

A) They are vulnerable to cryptographic attacks
B) They make HTTPS slower
C) They are not supported by modern browsers
D) They reduce SSL certificate validity

✅ Answer: A) They are vulnerable to cryptographic attacks
Explanation: Older TLS versions like 1.0 and 1.1 have security flaws and should not be used.

---

71. What is an elliptic curve cryptography (ECC) advantage in TLS?

A) It provides stronger encryption with smaller key sizes
B) It replaces RSA encryption
C) It eliminates the need for SSL certificates
D) It forces all browsers to use HTTPS

✅ Answer: A) It provides stronger encryption with smaller key sizes
Explanation: ECC offers high security with shorter key lengths, making it efficient for secure communication.

---

72. How does DNSSEC complement HTTPS security?

A) It prevents DNS spoofing and ensures integrity of domain resolution
B) It encrypts TLS certificates
C) It forces websites to use HSTS
D) It replaces SSL/TLS encryption

✅ Answer: A) It prevents DNS spoofing and ensures integrity of domain resolution
Explanation: DNSSEC secures DNS lookups, preventing attackers from redirecting users to malicious sites.

---

73. What is a TLS renegotiation attack?

A) An attack that exploits vulnerabilities in TLS session renegotiation
B) A brute-force attack on encryption keys
C) A phishing attack targeting HTTPS websites
D) A method for renewing expired certificates

✅ Answer: A) An attack that exploits vulnerabilities in TLS session renegotiation
Explanation: TLS renegotiation attacks allow an attacker to inject malicious data into an encrypted session.

---

74. What is the primary reason SSL/TLS handshakes can be slow?

A) They require multiple round trips between client and server
B) They encrypt all website images
C) They require browsers to be updated frequently
D) They store data permanently in browser cache

✅ Answer: A) They require multiple round trips between client and server
Explanation: The SSL/TLS handshake involves multiple communication steps, including key exchange and certificate validation, which introduce some delay.

---

75. What does TLS False Start do?

A) It reduces handshake time by sending encrypted data before handshake completion
B) It forces TLS 1.2 to downgrade to TLS 1.1
C) It adds an extra layer of encryption
D) It blocks self-signed certificates

✅ Answer: A) It reduces handshake time by sending encrypted data before handshake completion
Explanation: TLS False Start improves performance by sending encrypted data before the full handshake process finishes.

---

76. What is a TLS downgrade attack commonly used for?

A) To force a secure connection to fall back to an older, weaker version of TLS
B) To upgrade encryption strength
C) To encrypt stored data
D) To block access to HTTP websites

✅ Answer: A) To force a secure connection to fall back to an older, weaker version of TLS
Explanation: TLS downgrade attacks trick clients into using insecure versions like SSL 3.0 or TLS 1.0.

---

77. What is the primary function of a TLS session ticket?

A) To allow faster reconnection without full handshake
B) To store encryption keys permanently
C) To enforce HSTS policies
D) To replace SSL certificates

✅ Answer: A) To allow faster reconnection without full handshake
Explanation: TLS session tickets help resume encrypted connections faster by avoiding redundant handshakes.

---

78. Why should TLS 1.3 be preferred over TLS 1.2?

A) It eliminates weaker encryption algorithms
B) It has a faster handshake process
C) It removes support for RSA key exchange
D) All of the above

✅ Answer: D) All of the above
Explanation: TLS 1.3 removes outdated cryptographic methods, enhances security, and improves handshake speed.

---

79. What is the main function of a digital certificate in HTTPS?

A) To verify the website’s identity
B) To speed up web page loading
C) To encrypt images on a webpage
D) To prevent JavaScript execution

✅ Answer: A) To verify the website’s identity
Explanation: Digital certificates confirm that a website is authentic and establish a secure connection.

---

80. Why is session hijacking a major concern in insecure HTTPS setups?

A) Attackers can steal active session cookies and impersonate users
B) It slows down TLS connections
C) It prevents users from logging into websites
D) It disables encryption

✅ Answer: A) Attackers can steal active session cookies and impersonate users
Explanation: Session hijacking allows attackers to take over authenticated sessions, often due to insecure cookie handling.

---

81. What does a TLS Cipher Suite consist of?

A) Key exchange, authentication, encryption, and message integrity algorithms
B) The number of website visitors using HTTPS
C) The security headers included in HTTPS requests
D) The SSL certificate expiration date

✅ Answer: A) Key exchange, authentication, encryption, and message integrity algorithms
Explanation: A TLS Cipher Suite defines the cryptographic algorithms used in a secure connection.

---

82. Why is OCSP stapling recommended for TLS certificates?

A) It improves certificate revocation checks by reducing latency
B) It replaces the need for HTTPS
C) It eliminates the need for TLS encryption
D) It forces websites to use wildcard certificates

✅ Answer: A) It improves certificate revocation checks by reducing latency
Explanation: OCSP stapling allows servers to send certificate revocation status directly to clients, improving performance.

---

83. What is the primary purpose of a Domain Validation (DV) SSL certificate?

A) To verify domain ownership
B) To provide extended identity verification
C) To block phishing attacks
D) To encrypt DNS queries

✅ Answer: A) To verify domain ownership
Explanation: DV SSL certificates confirm that the certificate holder controls the domain but do not verify business identity.

---

84. Why is TLS compression disabled in modern browsers?

A) It allows attackers to exploit CRIME attacks
B) It slows down encryption
C) It is not supported by TLS 1.3
D) It reduces SSL certificate effectiveness

✅ Answer: A) It allows attackers to exploit CRIME attacks
Explanation: TLS compression can leak encrypted data, making it vulnerable to CRIME attacks.

---

85. What is the role of a client certificate in mutual TLS authentication?

A) It authenticates the client to the server
B) It encrypts web pages
C) It prevents brute-force attacks
D) It blocks insecure HTTP connections

✅ Answer: A) It authenticates the client to the server
Explanation: Mutual TLS (mTLS) requires both the client and server to present valid certificates for authentication.

---

86. How can an attacker exploit weak TLS certificate validation?

A) By using a fraudulent certificate to impersonate a website
B) By increasing website load time
C) By blocking HTTPS connections
D) By preventing users from accessing the internet

✅ Answer: A) By using a fraudulent certificate to impersonate a website
Explanation: Weak TLS validation allows attackers to use fake certificates for phishing or MITM attacks.

---

87. What security risk arises from using the RC4 cipher in TLS?

A) It is vulnerable to cryptographic attacks that can reveal plaintext
B) It forces websites to use self-signed certificates
C) It prevents HTTPS from being used
D) It blocks TLS handshakes

✅ Answer: A) It is vulnerable to cryptographic attacks that can reveal plaintext
Explanation: The RC4 cipher has known vulnerabilities and should not be used in secure TLS connections.

---

88. What is the primary benefit of using Let’s Encrypt SSL certificates?

A) They are free and automate certificate issuance
B) They provide the strongest encryption available
C) They eliminate the need for TLS handshakes
D) They replace the need for HTTPS

✅ Answer: A) They are free and automate certificate issuance
Explanation: Let’s Encrypt provides free SSL certificates with automated renewal, promoting wider HTTPS adoption.

---

89. What is an SNI (Server Name Indication) in TLS?

A) A TLS extension that allows multiple HTTPS websites to be hosted on the same IP address
B) A protocol that replaces HTTPS
C) A tool for preventing DNS spoofing
D) A method for encrypting email

✅ Answer: A) A TLS extension that allows multiple HTTPS websites to be hosted on the same IP address
Explanation: SNI allows multiple domains to use different SSL certificates on a shared IP address.

---

90. Why is the use of deprecated TLS cipher suites discouraged?

A) They have known vulnerabilities that make them easier to exploit
B) They slow down web page loading
C) They prevent search engines from ranking websites
D) They require expensive certificates

✅ Answer: A) They have known vulnerabilities that make them easier to exploit
Explanation: Deprecated cipher suites are vulnerable to attacks like BEAST, POODLE, and FREAK.

---

91. What is the impact of a compromised TLS private key?

A) Attackers can decrypt encrypted HTTPS traffic
B) It forces TLS connections to downgrade
C) It makes HTTP websites faster
D) It prevents TLS certificates from expiring

✅ Answer: A) Attackers can decrypt encrypted HTTPS traffic
Explanation: If an attacker gains access to a TLS private key, they can impersonate the website and decrypt past traffic if forward secrecy is not used.

---

92. Why is using TLS 1.0 and TLS 1.1 no longer recommended?

A) They contain known security vulnerabilities
B) They are incompatible with IPv6
C) They slow down website performance
D) They do not support HTTPS

✅ Answer: A) They contain known security vulnerabilities
Explanation: TLS 1.0 and 1.1 are outdated and vulnerable to attacks like BEAST and POODLE, making them unsafe for encrypted communication.

---

93. What is a TLS MITM (Man-in-the-Middle) attack?

A) An attack where an attacker intercepts and manipulates encrypted traffic
B) A brute-force attack on TLS certificates
C) A type of phishing attack
D) A method for speeding up HTTPS connections

✅ Answer: A) An attack where an attacker intercepts and manipulates encrypted traffic
Explanation: A MITM attack occurs when an attacker secretly relays and alters communication between two parties using weak or misconfigured TLS.

---

94. What is the purpose of a Certificate Authority (CA)?

A) To issue, validate, and revoke digital certificates
B) To store website cookies securely
C) To encrypt JavaScript files
D) To detect malware on websites

✅ Answer: A) To issue, validate, and revoke digital certificates
Explanation: CAs ensure that digital certificates used in HTTPS are valid and trustworthy.

---

95. What happens when a browser encounters a revoked SSL/TLS certificate?

A) It blocks access to the website and shows a security warning
B) It forces a downgrade to HTTP
C) It bypasses encryption and loads the page normally
D) It automatically renews the certificate

✅ Answer: A) It blocks access to the website and shows a security warning
Explanation: A revoked SSL/TLS certificate indicates a security issue, and browsers will prevent users from accessing the site.

---

96. What is the main function of the OCSP (Online Certificate Status Protocol)?

A) To check whether a TLS certificate has been revoked
B) To force HTTPS on a website
C) To encrypt cookies
D) To prevent TLS downgrade attacks

✅ Answer: A) To check whether a TLS certificate has been revoked
Explanation: OCSP allows browsers to verify in real-time whether a certificate is still valid.

---

97. How does TLS protect data in transit?

A) By encrypting communication between the client and server
B) By blocking malware downloads
C) By preventing SQL Injection
D) By removing tracking cookies

✅ Answer: A) By encrypting communication between the client and server
Explanation: TLS ensures that data transmitted over the internet remains encrypted and secure from eavesdropping and tampering.

---

98. What is the impact of using an expired TLS certificate?

A) The website will display a security warning to users
B) The website will automatically switch to HTTP
C) The website will lose all its data
D) The TLS handshake will take longer

✅ Answer: A) The website will display a security warning to users
Explanation: Expired certificates make websites appear untrustworthy, leading browsers to warn users before they proceed.

---

99. What is an SSL/TLS chain of trust?

A) A hierarchy of certificates that verify a website’s authenticity
B) A method for encrypting cookies
C) A technique for improving website speed
D) A way to block phishing websites

✅ Answer: A) A hierarchy of certificates that verify a website’s authenticity
Explanation: The SSL/TLS chain of trust links a website’s certificate to an intermediate CA and a trusted root CA.

---

100. How does HTTP Strict Transport Security (HSTS) improve HTTPS security?

A) It forces browsers to always use HTTPS instead of HTTP
B) It replaces TLS with a new encryption method
C) It encrypts JavaScript files
D) It automatically renews SSL certificates

✅ Answer: A) It forces browsers to always use HTTPS instead of HTTP
Explanation: HSTS prevents SSL stripping attacks by ensuring that a website can only be accessed over HTTPS.

---

101. Why is a TLS renegotiation vulnerability dangerous?

A) It allows attackers to inject malicious data into an encrypted session
B) It prevents HTTPS from being used
C) It speeds up TLS encryption
D) It removes session cookies

✅ Answer: A) It allows attackers to inject malicious data into an encrypted session
Explanation: TLS renegotiation flaws allow attackers to insert malicious data into an encrypted communication.

---

102. What does a digital certificate’s Common Name (CN) specify?

A) The domain name or subdomain the certificate is issued for
B) The encryption strength of TLS
C) The security headers used on the website
D) The TLS version being used

✅ Answer: A) The domain name or subdomain the certificate is issued for
Explanation: The Common Name (CN) field in an SSL certificate specifies the domain it is meant to protect.

---

103. What is a self-signed SSL/TLS certificate typically used for?

A) Internal development, testing, or local environments
B) Public-facing websites
C) Online banking transactions
D) High-security applications

✅ Answer: A) Internal development, testing, or local environments
Explanation: Self-signed certificates are not trusted by browsers and are mostly used for internal testing.

---

104. Why should wildcard SSL certificates be used carefully?

A) If compromised, they can be used to impersonate all subdomains
B) They slow down website performance
C) They do not support HTTPS encryption
D) They require constant renewal

✅ Answer: A) If compromised, they can be used to impersonate all subdomains
Explanation: A compromised wildcard certificate affects all associated subdomains, increasing security risks.

---

105. What is a TLS session resumption attack?

A) An attack that hijacks an existing TLS session
B) An attack that forces HTTP instead of HTTPS
C) A brute-force attack on a website
D) A phishing technique targeting HTTPS websites

✅ Answer: A) An attack that hijacks an existing TLS session
Explanation: Attackers can attempt to resume a TLS session without proper validation, leading to session hijacking.

---

106. What role does Public Key Infrastructure (PKI) play in TLS?

A) It manages encryption keys and digital certificates
B) It speeds up HTTPS connections
C) It prevents brute-force attacks
D) It blocks phishing attempts

✅ Answer: A) It manages encryption keys and digital certificates
Explanation: PKI is the framework that enables encryption and authentication through digital certificates.

---

107. What is a TLS certificate fingerprint?

A) A unique hash that identifies a specific SSL/TLS certificate
B) A method for encrypting JavaScript files
C) A technique for optimizing website speed
D) A way to prevent SQL Injection

✅ Answer: A) A unique hash that identifies a specific SSL/TLS certificate
Explanation: A TLS fingerprint is a cryptographic hash of a certificate, used for verification.

---

108. What is the primary function of a TLS key exchange?

A) To securely share encryption keys between client and server
B) To verify browser security settings
C) To block phishing websites
D) To improve website loading speed

✅ Answer: A) To securely share encryption keys between client and server
Explanation: TLS key exchange ensures that both parties can securely communicate using a shared encryption key.

---

109. What is the role of Diffie-Hellman in TLS?

A) To securely exchange encryption keys over an insecure network
B) To generate SSL certificates
C) To block HTTP websites
D) To manage domain registrations

✅ Answer: A) To securely exchange encryption keys over an insecure network
Explanation: Diffie-Hellman enables secure key exchange without requiring prior shared secrets.

---

110. What security risk does an improperly configured TLS certificate pose?

A) It can allow attackers to impersonate a website
B) It increases website loading time
C) It prevents search engines from indexing a site
D) It disables JavaScript

✅ Answer: A) It can allow attackers to impersonate a website
Explanation: A misconfigured or compromised TLS certificate can enable phishing and MITM attacks.

---

111. What does HTTPS use to provide encryption?

A) AES encryption only
B) SSL/TLS protocols
C) RSA encryption only
D) DNSSEC

✅ Answer: B) SSL/TLS protocols
Explanation: HTTPS secures web traffic using SSL/TLS protocols, ensuring encryption, integrity, and authentication.

---

112. What does a TLS handshake establish between a client and a server?

A) A secure connection with agreed-upon encryption parameters
B) A firewall rule to block phishing attacks
C) A method for reducing website loading times
D) A script to remove expired certificates

✅ Answer: A) A secure connection with agreed-upon encryption parameters
Explanation: The TLS handshake negotiates encryption methods and keys before securely transmitting data.

---

113. What happens if a website’s TLS certificate is issued by an untrusted Certificate Authority (CA)?

A) Browsers display a warning message
B) The site loads faster
C) The site becomes vulnerable to XSS attacks
D) The certificate is automatically trusted after 24 hours

✅ Answer: A) Browsers display a warning message
Explanation: Browsers warn users if a TLS certificate comes from an untrusted CA, as it could be fraudulent.

---

114. What is the purpose of a TLS Pre-Shared Key (PSK)?

A) To allow faster, secure communications using a previously shared key
B) To replace SSL certificates
C) To block phishing attacks
D) To enforce HTTP instead of HTTPS

✅ Answer: A) To allow faster, secure communications using a previously shared key
Explanation: PSK-based TLS sessions enable encryption without the need for an extensive handshake.

---

115. What is a wildcard certificate’s primary advantage?

A) It can secure multiple subdomains under one certificate
B) It is stronger than RSA encryption
C) It never expires
D) It provides end-to-end encryption

✅ Answer: A) It can secure multiple subdomains under one certificate
Explanation: Wildcard SSL certificates allow securing a domain and all its subdomains (e.g., *.example.com) with one certificate.

---

116. What does the term “TLS mutual authentication” mean?

A) Both the client and server authenticate each other using digital certificates
B) The TLS handshake completes twice
C) The TLS certificate auto-renews
D) TLS is replaced with another encryption protocol

✅ Answer: A) Both the client and server authenticate each other using digital certificates
Explanation: Mutual TLS authentication ensures both parties in a connection are verified for added security.

---

117. What is the impact of not using HTTPS on a login page?

A) User credentials can be intercepted via a MITM attack
B) The website loads faster
C) The site remains secure with HTTP
D) The site automatically switches to HTTPS

✅ Answer: A) User credentials can be intercepted via a MITM attack
Explanation: Without HTTPS, login credentials are transmitted in plaintext, making them vulnerable to eavesdropping.

---

118. How does HTTP Public Key Pinning (HPKP) enhance TLS security?

A) By allowing websites to specify which certificates should be trusted for their domain
B) By forcing TLS certificates to renew every 24 hours
C) By preventing expired certificates from being used
D) By encrypting DNS queries

✅ Answer: A) By allowing websites to specify which certificates should be trusted for their domain
Explanation: HPKP prevents certificate spoofing by allowing a website to “pin” specific public keys to be trusted.

---

119. What does the POODLE attack target?

A) SSL 3.0’s weak CBC encryption mode
B) Weak DNSSEC configurations
C) TLS 1.3 encryption
D) HTTPS-to-HTTP redirects

✅ Answer: A) SSL 3.0’s weak CBC encryption mode
Explanation: The POODLE attack exploits a vulnerability in SSL 3.0’s CBC mode, making it susceptible to downgrade attacks.

---

120. Why is Extended Validation (EV) SSL important?

A) It verifies the legal identity of an organization before issuing a certificate
B) It prevents all XSS attacks
C) It blocks MITM attacks completely
D) It forces automatic HTTPS redirection

✅ Answer: A) It verifies the legal identity of an organization before issuing a certificate
Explanation: EV certificates provide the highest level of validation, displaying the organization’s name in the browser address bar.

---

121. Why should TLS private keys never be shared publicly?

A) Attackers can use them to impersonate a website and decrypt data
B) It slows down website speed
C) It prevents HTTPS from working properly
D) It forces the site to downgrade to HTTP

✅ Answer: A) Attackers can use them to impersonate a website and decrypt data
Explanation: If an attacker gains access to a private TLS key, they can launch MITM attacks and decrypt communications.

---

122. What is the primary security risk of a self-signed SSL/TLS certificate?

A) It is not trusted by browsers, making it susceptible to MITM attacks
B) It increases website load times
C) It weakens the strength of HTTPS encryption
D) It prevents TLS handshake completion

✅ Answer: A) It is not trusted by browsers, making it susceptible to MITM attacks
Explanation: Self-signed certificates do not provide trusted verification, making them vulnerable to MITM attacks.

---

123. How does TLS Forward Secrecy (FS) protect past encrypted sessions?

A) It generates unique session keys that cannot be reused
B) It encrypts passwords at rest
C) It forces TLS certificates to renew daily
D) It eliminates the need for a TLS handshake

✅ Answer: A) It generates unique session keys that cannot be reused
Explanation: Forward Secrecy ensures that if a private key is compromised, past encrypted sessions remain secure.

---

124. Why is it essential to regularly update SSL/TLS certificates?

A) To maintain security, trust, and compliance
B) To make websites load faster
C) To prevent TLS downgrade attacks
D) To remove all HTTP headers

✅ Answer: A) To maintain security, trust, and compliance
Explanation: Regularly updating TLS certificates ensures that they remain valid, secure, and aligned with best practices.

---

125. How does a browser validate a TLS certificate?

A) By checking its trust chain and verifying the CA signature
B) By scanning for malware
C) By encrypting the certificate
D) By comparing it to cached web data

✅ Answer: A) By checking its trust chain and verifying the CA signature
Explanation: Browsers validate TLS certificates by ensuring they are issued by a trusted CA and have not expired or been revoked.

---

126. What is the purpose of Certificate Transparency logs?

A) To prevent fraudulent or misissued certificates
B) To encrypt TLS handshakes
C) To improve website loading speeds
D) To replace the need for CAs

✅ Answer: A) To prevent fraudulent or misissued certificates
Explanation: Certificate Transparency (CT) logs ensure that all issued certificates are publicly recorded to prevent misuse.

---

127. What does a self-signed certificate lack compared to a CA-issued certificate?

A) Third-party validation and trust
B) Encryption capabilities
C) A public key
D) Secure hashing algorithms

✅ Answer: A) Third-party validation and trust
Explanation: Self-signed certificates are not issued by a trusted CA, so browsers treat them as untrusted.

---

128. Why should wildcard certificates be carefully managed?

A) A compromised wildcard certificate can be used to impersonate all subdomains
B) They prevent TLS from functioning
C) They block DNSSEC
D) They reduce encryption strength

✅ Answer: A) A compromised wildcard certificate can be used to impersonate all subdomains
Explanation: If a wildcard certificate is compromised, attackers can use it to issue fake certificates for any subdomain.

---

129. What is the purpose of a TLS session ticket?

A) To allow resumption of encrypted sessions without a full handshake
B) To replace expired TLS certificates
C) To encrypt TLS certificates
D) To generate new private keys

✅ Answer: A) To allow resumption of encrypted sessions without a full handshake
Explanation: TLS session tickets allow for faster re-establishment of secure connections.

---

130. What is the primary function of a TLS cipher suite?

A) Defines encryption, authentication, and integrity mechanisms used in TLS
B) Prevents DNS spoofing
C) Automatically renews expired certificates
D) Encrypts stored passwords

✅ Answer: A) Defines encryption, authentication, and integrity mechanisms used in TLS
Explanation: A TLS cipher suite specifies the cryptographic algorithms used for secure communications.

---

131. Why is HTTPS preferred over HTTP for e-commerce websites?

A) It encrypts payment and user data, preventing interception
B) It makes the website faster
C) It blocks all types of cyber attacks
D) It prevents CAPTCHA verifications

✅ Answer: A) It encrypts payment and user data, preventing interception
Explanation: HTTPS ensures secure transactions by encrypting customer data, making it essential for e-commerce sites.

---

132. What does the term “TLS fingerprinting” refer to?

A) Identifying unique characteristics of a TLS handshake
B) Encrypting SSL certificates
C) Blocking HTTPS traffic
D) Speeding up TLS handshakes

✅ Answer: A) Identifying unique characteristics of a TLS handshake
Explanation: TLS fingerprinting is used to detect and analyze the encryption characteristics of a client or server.

---

133. What is the key advantage of using elliptic curve cryptography (ECC) in TLS?

A) It provides strong encryption with smaller key sizes
B) It replaces TLS entirely
C) It removes the need for SSL certificates
D) It blocks phishing websites

✅ Answer: A) It provides strong encryption with smaller key sizes
Explanation: ECC offers robust encryption while requiring shorter key lengths, making it efficient and secure.

---

134. Why should TLS certificates be regularly rotated?

A) To reduce the risk of compromise and maintain security
B) To improve website speed
C) To block all HTTP connections
D) To ensure wildcard certificates always work

✅ Answer: A) To reduce the risk of compromise and maintain security
Explanation: Regular certificate rotation minimizes exposure to compromised or outdated encryption keys.

---

135. What happens if a TLS certificate is not signed by a trusted CA?

A) Browsers display a warning about an untrusted connection
B) The website loads faster
C) The certificate automatically gets trusted after 24 hours
D) The website forces a downgrade to HTTP

✅ Answer: A) Browsers display a warning about an untrusted connection
Explanation: Certificates issued by untrusted authorities trigger security warnings in browsers.

---

136. How does TLS protect against replay attacks?

A) By using unique session keys and timestamps
B) By forcing websites to renew certificates daily
C) By blocking HTTP requests
D) By disabling cookies

✅ Answer: A) By using unique session keys and timestamps
Explanation: TLS prevents replay attacks by using time-sensitive cryptographic elements that expire quickly.

---

137. What is a TLS stripping attack?

A) An attack that forces a website to downgrade from HTTPS to HTTP
B) A technique for optimizing TLS encryption
C) A method for improving HTTPS speed
D) A brute-force attack on TLS keys

✅ Answer: A) An attack that forces a website to downgrade from HTTPS to HTTP
Explanation: TLS stripping downgrades secure connections to unencrypted HTTP, making data vulnerable.

---

138. How can organizations detect fraudulent TLS certificates?

A) By monitoring Certificate Transparency logs
B) By blocking all wildcard certificates
C) By disabling SSL 3.0
D) By using older TLS versions

✅ Answer: A) By monitoring Certificate Transparency logs
Explanation: Certificate Transparency logs allow organizations to track unauthorized or fraudulent certificates.

---

139. What is the primary function of TLS session caching?

A) To speed up reconnections by storing session parameters
B) To block HTTP-only sites
C) To prevent phishing attacks
D) To remove expired certificates

✅ Answer: A) To speed up reconnections by storing session parameters
Explanation: TLS session caching improves performance by reusing previously established secure sessions.

---

140. What does the Heartbleed vulnerability affect?

A) OpenSSL’s improper handling of heartbeat messages
B) HTTPS redirections
C) Browser caching
D) Wildcard certificate validation

✅ Answer: A) OpenSSL’s improper handling of heartbeat messages
Explanation: Heartbleed exploited a flaw in OpenSSL, allowing attackers to read sensitive memory data.

---

141. What is the impact of using outdated cryptographic algorithms in TLS?

A) It increases vulnerability to attacks like BEAST, POODLE, and FREAK
B) It makes websites load faster
C) It forces browsers to block TLS connections
D) It speeds up certificate verification

✅ Answer: A) It increases vulnerability to attacks like BEAST, POODLE, and FREAK
Explanation: Outdated cryptographic methods make TLS communications susceptible to known exploits.

---

142. Why should SSL/TLS private keys be stored securely?

A) If exposed, they can be used to decrypt encrypted communications
B) They speed up HTTPS connections
C) They replace the need for authentication
D) They prevent MITM attacks

✅ Answer: A) If exposed, they can be used to decrypt encrypted communications
Explanation: Private keys must remain secure to prevent unauthorized access and decryption.

---

143. How does a TLS downgrade attack work?

A) It tricks a server into using an older, weaker version of TLS
B) It blocks HTTPS connections
C) It speeds up web page loading
D) It replaces a website’s certificate

✅ Answer: A) It tricks a server into using an older, weaker version of TLS
Explanation: Downgrade attacks force the use of vulnerable TLS versions, making encrypted connections less secure.

---

144. What is the purpose of a TLS Certificate Revocation List (CRL)?

A) To list certificates that are no longer valid
B) To prevent all TLS certificates from expiring
C) To encrypt TLS handshakes
D) To replace DNSSEC

✅ Answer: A) To list certificates that are no longer valid
Explanation: A CRL ensures that compromised or expired certificates are not mistakenly trusted.

---

145. Why is certificate pinning recommended for high-security applications?

A) It prevents attackers from using fraudulent certificates to impersonate trusted sites
B) It makes websites load faster
C) It prevents phishing emails
D) It forces browsers to automatically renew TLS certificates

✅ Answer: A) It prevents attackers from using fraudulent certificates to impersonate trusted sites
Explanation: Certificate pinning ensures that only a predefined set of trusted certificates is accepted.

---

146. What is the role of a root CA in SSL/TLS?

A) It issues and verifies the legitimacy of other certificates in a trust chain
B) It blocks phishing websites
C) It prevents HTTP sites from loading
D) It forces HTTPS automatically

✅ Answer: A) It issues and verifies the legitimacy of other certificates in a trust chain
Explanation: Root Certificate Authorities (CAs) are responsible for signing and verifying SSL/TLS certificates.

---

147. What does the TLS Change Cipher Spec message indicate?

A) That the handshake is complete and encrypted communication can begin
B) That the server is switching to a different certificate authority
C) That the session is about to expire
D) That HTTP connections are being blocked

✅ Answer: A) That the handshake is complete and encrypted communication can begin
Explanation: The Change Cipher Spec message in TLS indicates that parties should switch to an encrypted state.

---

148. What does the TLS Record Layer do?

A) It encrypts and transmits application data securely
B) It manages SSL certificate renewals
C) It replaces the need for encryption keys
D) It speeds up certificate validation

✅ Answer: A) It encrypts and transmits application data securely
Explanation: The TLS Record Layer handles encryption, integrity, and secure transmission of data.

---

149. What is the function of the TLS Handshake Protocol?

A) To establish secure communication parameters between the client and server
B) To renew expired SSL/TLS certificates
C) To block MITM attacks automatically
D) To encrypt all stored data on the server

✅ Answer: A) To establish secure communication parameters between the client and server
Explanation: The TLS handshake determines encryption algorithms, exchanges keys, and authenticates parties before secure communication begins.

---

150. What security risk arises when a website does not implement TLS encryption?

A) Sensitive data can be intercepted by attackers
B) The website will load slower
C) The website cannot display images properly
D) Users will be unable to log in

✅ Answer: A) Sensitive data can be intercepted by attackers
Explanation: Without TLS, data travels in plaintext, allowing attackers to capture login credentials, credit card details, and other sensitive information.

---

151. How does TLS 1.3 improve security over TLS 1.2?

A) It removes outdated cryptographic algorithms like RSA key exchange
B) It eliminates the need for SSL certificates
C) It speeds up website loading times by 200%
D) It automatically renews TLS certificates

✅ Answer: A) It removes outdated cryptographic algorithms like RSA key exchange
Explanation: TLS 1.3 enhances security by removing weaker cryptographic methods and enforcing forward secrecy.

---

152. What is a self-signed certificate’s biggest security flaw?

A) It is not verified by a trusted CA, making it vulnerable to MITM attacks
B) It speeds up HTTPS connections too much
C) It prevents websites from using DNSSEC
D) It forces automatic certificate renewal

✅ Answer: A) It is not verified by a trusted CA, making it vulnerable to MITM attacks
Explanation: Self-signed certificates lack third-party validation, allowing attackers to create fraudulent certificates for phishing.

---

153. What is the purpose of the TLS Finished message in the handshake?

A) It confirms that the handshake is complete and secure communication can start
B) It requests a new encryption key
C) It signals the termination of the session
D) It enforces strict HTTPS policies

✅ Answer: A) It confirms that the handshake is complete and secure communication can start
Explanation: The Finished message ensures that both parties agree on the encryption parameters before transmitting data.

---

154. What is an ephemeral key in TLS?

A) A short-lived encryption key used for a single session
B) A certificate that automatically renews
C) A permanent private key stored on the server
D) A key used only for TLS 1.0

✅ Answer: A) A short-lived encryption key used for a single session
Explanation: Ephemeral keys provide forward secrecy by generating a new key for each session, reducing the risk of decryption.

---

155. How does HTTP downgrade to HTTPS when HSTS is enforced?

A) It does not, because HSTS forces all connections to use HTTPS
B) By sending a redirect request to the browser
C) By modifying DNSSEC settings
D) By encrypting the HTTP response header

✅ Answer: A) It does not, because HSTS forces all connections to use HTTPS
Explanation: HSTS (HTTP Strict Transport Security) ensures that once a website enforces HTTPS, it cannot be downgraded to HTTP.

---

156. What does a TLS session ticket do?

A) It allows a TLS session to resume without a full handshake
B) It replaces SSL certificates
C) It encrypts DNSSEC queries
D) It blocks brute-force attacks

✅ Answer: A) It allows a TLS session to resume without a full handshake
Explanation: TLS session tickets store encrypted session parameters, allowing faster reconnections without renegotiating encryption keys.

---

157. What does the term “Perfect Forward Secrecy” (PFS) mean in TLS?

A) Compromised encryption keys cannot be used to decrypt past sessions
B) Encryption keys never expire
C) SSL certificates auto-renew forever
D) It enforces strict certificate pinning

✅ Answer: A) Compromised encryption keys cannot be used to decrypt past sessions
Explanation: PFS ensures that each session uses a unique encryption key, so even if a private key is stolen, past sessions remain secure.

---

158. What happens if a web server uses an expired TLS certificate?

A) Browsers display a warning and may block the connection
B) The website forces HTTPS to HTTP downgrade
C) The certificate renews itself automatically
D) Users will not be able to enter login credentials

✅ Answer: A) Browsers display a warning and may block the connection
Explanation: Expired TLS certificates trigger browser warnings, potentially discouraging users from visiting the website.

---

159. Why should organizations use Certificate Transparency (CT)?

A) To detect unauthorized or fraudulent certificates
B) To replace TLS encryption
C) To speed up HTTPS connections
D) To force all users to accept self-signed certificates

✅ Answer: A) To detect unauthorized or fraudulent certificates
Explanation: Certificate Transparency logs help organizations detect misissued or compromised certificates.

---

160. What is the primary reason TLS session resumption is used?

A) To speed up reconnections without performing a full handshake
B) To encrypt stored passwords
C) To block insecure DNS queries
D) To prevent phishing attacks

✅ Answer: A) To speed up reconnections without performing a full handshake
Explanation: TLS session resumption improves performance by allowing clients to reconnect quickly using stored session parameters.

---

161. What does an SSL/TLS certificate’s expiration date indicate?

A) The last valid date before the certificate must be renewed
B) The date when HTTPS stops working entirely
C) The date when all browser support ends for the website
D) The date when encryption keys automatically change

✅ Answer: A) The last valid date before the certificate must be renewed
Explanation: After expiration, a TLS certificate must be renewed to maintain trust and secure connections.

---

162. What happens when an attacker exploits a weak TLS configuration?

A) They can intercept, modify, or decrypt encrypted communications
B) They can disable CAPTCHA verification
C) They can increase the speed of HTTPS handshakes
D) They can block JavaScript execution

✅ Answer: A) They can intercept, modify, or decrypt encrypted communications
Explanation: Weak TLS configurations make data vulnerable to interception, manipulation, and MITM attacks.

---

163. What is the primary security risk of using weak cipher suites in TLS?

A) They allow attackers to break encryption more easily
B) They slow down website performance
C) They prevent HTTPS from working
D) They block certificate expiration

✅ Answer: A) They allow attackers to break encryption more easily
Explanation: Weak cipher suites use outdated encryption methods that can be exploited by attackers.

---

164. What role does DNS over HTTPS (DoH) play in TLS security?

A) It encrypts DNS queries to prevent interception
B) It replaces HTTPS encryption
C) It forces TLS certificates to expire
D) It disables TLS handshakes

✅ Answer: A) It encrypts DNS queries to prevent interception
Explanation: DoH secures DNS lookups by encrypting them, preventing attackers from monitoring or modifying queries.

---

165. What does TLS OCSP stapling do?

A) Reduces the need for clients to check certificate revocation lists (CRLs)
B) Forces HTTPS connections
C) Replaces DNSSEC encryption
D) Blocks expired certificates

✅ Answer: A) Reduces the need for clients to check certificate revocation lists (CRLs)
Explanation: OCSP stapling speeds up revocation checks by allowing servers to provide proof of certificate validity directly.

---

166. What is the primary function of a TLS Certificate Authority (CA)?

A) To issue and validate SSL/TLS certificates
B) To encrypt user passwords
C) To block HTTP traffic
D) To speed up website performance

✅ Answer: A) To issue and validate SSL/TLS certificates
Explanation: A CA is responsible for verifying domain ownership and issuing digital certificates to establish trust in HTTPS connections.

---

167. How does a wildcard SSL certificate differ from a regular SSL certificate?

A) It secures multiple subdomains under a single certificate
B) It provides stronger encryption
C) It never expires
D) It prevents SQL Injection

✅ Answer: A) It secures multiple subdomains under a single certificate
Explanation: Wildcard SSL certificates allow multiple subdomains (e.g., *.example.com) to be secured under one certificate.

---

168. What is the biggest risk of using a compromised wildcard SSL certificate?

A) It can be used to impersonate all subdomains of a website
B) It forces browsers to disable HTTPS
C) It prevents TLS encryption
D) It slows down website performance

✅ Answer: A) It can be used to impersonate all subdomains of a website
Explanation: If a wildcard certificate is compromised, an attacker can issue fraudulent certificates for all subdomains of the affected domain.

---

169. What security risk does an incorrectly implemented TLS cipher suite create?

A) It may allow attackers to exploit weak encryption methods
B) It prevents websites from loading
C) It forces automatic certificate expiration
D) It disables HTTPS redirects

✅ Answer: A) It may allow attackers to exploit weak encryption methods
Explanation: Using weak or deprecated cipher suites (e.g., RC4) increases the risk of cryptographic attacks.

---

170. What is the main purpose of a TLS session key?

A) To encrypt the data being transmitted during a session
B) To replace SSL certificates
C) To prevent brute-force attacks
D) To authenticate user credentials

✅ Answer: A) To encrypt the data being transmitted during a session
Explanation: TLS session keys are dynamically generated to encrypt communication between a client and a server.

---

171. What is the impact of a certificate revocation on a website?

A) Browsers will show a security warning and may block access
B) The site will load faster
C) It forces users to reset their passwords
D) It disables TLS encryption

✅ Answer: A) Browsers will show a security warning and may block access
Explanation: Revoked certificates indicate a potential security risk, and browsers may block connections to the site.

---

172. Why is TLS 1.3 considered more secure than TLS 1.2?

A) It removes weaker encryption algorithms and enforces forward secrecy
B) It eliminates the need for digital certificates
C) It disables all HTTPS redirects
D) It prevents all MITM attacks

✅ Answer: A) It removes weaker encryption algorithms and enforces forward secrecy
Explanation: TLS 1.3 removes insecure algorithms and enforces encryption methods that protect past and future sessions.

---

173. What is the role of an intermediate CA in SSL/TLS?

A) It acts as a bridge between root CAs and end-user certificates
B) It encrypts JavaScript files
C) It replaces expired TLS certificates
D) It prevents SQL Injection

✅ Answer: A) It acts as a bridge between root CAs and end-user certificates
Explanation: Intermediate CAs provide an additional layer of trust between a website and the root CA.

---

174. What is the purpose of TLS session resumption?

A) To allow clients to reconnect securely without a full handshake
B) To force HTTPS on all websites
C) To encrypt stored passwords
D) To prevent brute-force attacks

✅ Answer: A) To allow clients to reconnect securely without a full handshake
Explanation: TLS session resumption speeds up reconnecting to secure websites by reusing session keys.

---

175. How does OCSP stapling improve TLS performance?

A) It allows the server to provide real-time certificate revocation status
B) It encrypts all HTTP requests
C) It prevents all types of MITM attacks
D) It speeds up SSL/TLS handshakes by bypassing encryption

✅ Answer: A) It allows the server to provide real-time certificate revocation status
Explanation: OCSP stapling improves security and performance by allowing a server to provide proof of certificate validity.

---

176. What is the purpose of a TLS fingerprint?

A) It uniquely identifies a client or server based on its handshake characteristics
B) It replaces SSL certificates
C) It forces a website to use HSTS
D) It prevents SQL Injection

✅ Answer: A) It uniquely identifies a client or server based on its handshake characteristics
Explanation: TLS fingerprinting is used for security monitoring and detection of suspicious network activity.

---

177. How can an attacker exploit an improperly configured HTTPS setup?

A) By performing a MITM attack and intercepting encrypted traffic
B) By forcing the website to use HSTS
C) By speeding up HTTPS handshakes
D) By blocking TLS encryption

✅ Answer: A) By performing a MITM attack and intercepting encrypted traffic
Explanation: Misconfigured HTTPS can allow attackers to intercept, modify, or downgrade encrypted connections.

---

178. Why should an expired SSL/TLS certificate be replaced immediately?

A) Browsers will warn users and may block access to the website
B) The certificate will automatically renew itself after 30 days
C) It forces the site to use DNSSEC
D) It prevents users from logging in

✅ Answer: A) Browsers will warn users and may block access to the website
Explanation: Expired certificates trigger browser warnings, discouraging users from visiting the website.

---

179. How does TLS prevent replay attacks?

A) By using unique session keys and timestamps
B) By encrypting the web server’s database
C) By blocking TLS handshakes
D) By forcing automatic certificate expiration

✅ Answer: A) By using unique session keys and timestamps
Explanation: TLS prevents replay attacks by ensuring that each encrypted session has a unique key and expiration mechanism.

---

180. What is a root certificate in TLS?

A) A high-trust certificate issued by a trusted CA at the top of the certificate hierarchy
B) A certificate that encrypts website cookies
C) A self-signed certificate used for local testing
D) A special certificate that does not expire

✅ Answer: A) A high-trust certificate issued by a trusted CA at the top of the certificate hierarchy
Explanation: Root certificates are the highest level of trust in SSL/TLS and are issued by globally trusted certificate authorities.

---

181. Why should organizations enforce HTTPS on all pages, not just login pages?

A) To prevent session hijacking and protect all user data in transit
B) To improve website loading speed
C) To disable tracking cookies
D) To force all users to reset passwords

✅ Answer: A) To prevent session hijacking and protect all user data in transit
Explanation: Encrypting all website traffic prevents attackers from intercepting session tokens or injecting malicious code.

---

182. What is a TLS downgrade attack also known as?

A) Protocol downgrade attack
B) SSL pinning attack
C) Quantum cryptography attack
D) Certificate spoofing attack

✅ Answer: A) Protocol downgrade attack
Explanation: TLS downgrade attacks force a connection to use an older, less secure encryption protocol.

---

183. What type of encryption is used in TLS to ensure secure communication?

A) Symmetric and asymmetric encryption
B) Only symmetric encryption
C) Only asymmetric encryption
D) Plaintext encryption

✅ Answer: A) Symmetric and asymmetric encryption
Explanation: TLS uses asymmetric encryption for key exchange and symmetric encryption for secure communication.

---

184. What is the primary risk of using an outdated TLS protocol?

A) It exposes encrypted traffic to known cryptographic attacks
B) It slows down HTTPS connections
C) It prevents DNS resolution
D) It blocks JavaScript execution

✅ Answer: A) It exposes encrypted traffic to known cryptographic attacks
Explanation: Older TLS versions (like TLS 1.0 and 1.1) are vulnerable to attacks like BEAST, POODLE, and FREAK.

---

185. Why is it essential to disable weak cipher suites in TLS configurations?

A) To prevent cryptographic attacks that exploit weak encryption algorithms
B) To speed up TLS handshakes
C) To enforce automatic certificate renewal
D) To allow HTTP connections to remain active

✅ Answer: A) To prevent cryptographic attacks that exploit weak encryption algorithms
Explanation: Weak cipher suites, such as those using RC4 or 3DES, are susceptible to known exploits.

---

186. What is the role of the TLS Change Cipher Spec message?

A) It signals that encryption is about to begin
B) It requests a new SSL certificate
C) It prevents HTTPS downgrade attacks
D) It verifies the root CA’s authenticity

✅ Answer: A) It signals that encryption is about to begin
Explanation: The Change Cipher Spec message is sent during the TLS handshake to confirm that future messages will be encrypted.

---

187. What does a TLS downgrade protection mechanism do?

A) It prevents attackers from forcing connections to use older, weaker encryption protocols
B) It speeds up TLS handshakes
C) It blocks expired SSL certificates
D) It enforces DNSSEC on all queries

✅ Answer: A) It prevents attackers from forcing connections to use older, weaker encryption protocols
Explanation: Downgrade protection ensures that attackers cannot trick a system into using insecure TLS versions.

---

188. What is the purpose of session identifiers in TLS?

A) To enable session resumption without a full handshake
B) To force browsers to check OCSP stapling
C) To encrypt server logs
D) To allow certificates to expire faster

✅ Answer: A) To enable session resumption without a full handshake
Explanation: TLS session identifiers allow clients to resume secure connections more efficiently.

---

189. How does an attacker exploit an improperly validated TLS certificate?

A) By using a fraudulent certificate to perform a man-in-the-middle (MITM) attack
B) By forcing all traffic to use HTTPS
C) By encrypting the server’s database
D) By disabling TLS handshakes

✅ Answer: A) By using a fraudulent certificate to perform a man-in-the-middle (MITM) attack
Explanation: Improper validation allows attackers to use fake certificates, intercepting encrypted communications.

---

190. What is a primary benefit of using TLS 1.3 over previous versions?

A) It eliminates insecure cryptographic algorithms and reduces handshake latency
B) It prevents SQL Injection
C) It allows certificates to be self-signed
D) It blocks all phishing attacks

✅ Answer: A) It eliminates insecure cryptographic algorithms and reduces handshake latency
Explanation: TLS 1.3 removes outdated encryption methods like RSA key exchange and optimizes handshake performance.

---

191. Why is the use of expired TLS certificates dangerous?

A) Users may ignore security warnings and proceed to an unsafe website
B) It speeds up HTTPS connections
C) It prevents brute-force attacks
D) It improves certificate validation

✅ Answer: A) Users may ignore security warnings and proceed to an unsafe website
Explanation: Expired certificates indicate a lack of security maintenance, making websites targets for phishing and MITM attacks.

---

192. What is the main function of the TLS alert protocol?

A) It notifies the client or server about errors or security issues during a TLS session
B) It forces websites to renew expired certificates
C) It prevents DDoS attacks
D) It encrypts all HTTP headers

✅ Answer: A) It notifies the client or server about errors or security issues during a TLS session
Explanation: TLS alerts provide diagnostic information about issues in the secure session.

---

193. How does DNS over HTTPS (DoH) improve online privacy?

A) By encrypting DNS queries to prevent eavesdropping and tampering
B) By blocking HTTP connections
C) By forcing TLS handshakes to complete faster
D) By disabling JavaScript-based tracking

✅ Answer: A) By encrypting DNS queries to prevent eavesdropping and tampering
Explanation: DoH ensures that DNS requests are securely encrypted, preventing attackers from monitoring browsing activity.

---

194. Why should organizations use HSTS (HTTP Strict Transport Security)?

A) To prevent attackers from downgrading HTTPS connections to HTTP
B) To automatically renew SSL certificates
C) To encrypt all JavaScript files on the website
D) To disable TLS session resumption

✅ Answer: A) To prevent attackers from downgrading HTTPS connections to HTTP
Explanation: HSTS forces browsers to use HTTPS for all communications with a website, mitigating SSL stripping attacks.

---

195. What does the “TLS renegotiation attack” exploit?

A) A vulnerability in session renegotiation that allows an attacker to inject malicious data
B) A weakness in JavaScript encryption
C) A flaw in TLS 1.3 that slows down handshakes
D) A method for forcing OCSP checks

✅ Answer: A) A vulnerability in session renegotiation that allows an attacker to inject malicious data
Explanation: TLS renegotiation attacks exploit insecure renegotiation processes to manipulate encrypted sessions.

---

196. Why is it important to use TLS instead of SSL?

A) SSL is outdated and vulnerable to multiple security attacks
B) TLS makes websites load faster
C) SSL prevents certificate expiration
D) SSL is still secure for modern web applications

✅ Answer: A) SSL is outdated and vulnerable to multiple security attacks
Explanation: SSL has several known vulnerabilities, making TLS the only recommended encryption protocol.

---

197. What is the main benefit of using mutual TLS (mTLS)?

A) It provides authentication for both the client and server
B) It eliminates the need for encryption keys
C) It allows certificates to auto-renew
D) It prevents all phishing attacks

✅ Answer: A) It provides authentication for both the client and server
Explanation: mTLS ensures that both parties in a TLS connection are authenticated using certificates.

---

198. How does TLS Forward Secrecy protect encrypted sessions?

A) It ensures that past encrypted communications remain secure even if the private key is compromised
B) It forces websites to use OCSP
C) It speeds up website loading
D) It replaces the need for HTTPS

✅ Answer: A) It ensures that past encrypted communications remain secure even if the private key is compromised
Explanation: Forward Secrecy uses ephemeral key exchange methods to prevent retroactive decryption.

---

199. Why should weak cipher suites be disabled in a TLS configuration?

A) They make encrypted communications vulnerable to attacks
B) They slow down HTTPS handshakes
C) They prevent DNS resolution
D) They block phishing websites

✅ Answer: A) They make encrypted communications vulnerable to attacks
Explanation: Weak cipher suites, such as those using DES or RC4, should be disabled to prevent exploits.

---

200. What is the impact of an SSL/TLS certificate mismatch?

A) Browsers display a security warning indicating an untrusted connection
B) The website loads faster
C) The certificate automatically renews itself
D) The website is prevented from using HTTPS

✅ Answer: A) Browsers display a security warning indicating an untrusted connection
Explanation: A certificate mismatch occurs when the domain name does not match the certificate, triggering browser warnings.