easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: An engineer reviews the TLS configuration for a…
Exhibit
Refer to the exhibit. Exhibit: ``` ssl_cert_path = /etc/ssl/certs/server.pem ssl_key_path = /etc/ssl/private/server.key ssl_protocols = TLSv1.2 TLSv1.3 ssl_ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 ssl_verify_client = optional ```
An engineer reviews the TLS configuration for a web server, which includes the following line: ssl_verify_client optional; Which of the following is a security concern present in this configuration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The server does not require client certificates for authentication.
The TLS configuration sets ssl_verify_client to optional, allowing clients to connect without a certificate. This undermines mutual TLS (mTLS) enforcement, leaving the server vulnerable to unauthorized access if client authentication is expected. Option A is incorrect; perfect forward secrecy is provided by modern cipher suites, and its absence is not a concern here. Option B is incorrect; TLS 1.2 and 1.3 are industry-standard secure protocols. Option C is incorrect; the private key path is outside the document root and properly secured, which is a typical configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The cipher suite does not include perfect forward secrecy (PFS).
Why it's wrong here
ECDHE provides ephemeral Diffie-Hellman, ensuring PFS. The cipher suite includes ECDHE.
- ✗
The configuration supports outdated TLS 1.2 protocols.
Why it's wrong here
TLS 1.2 is still considered secure when used with strong ciphers; TLS 1.3 is also allowed. This is not a major concern.
- ✗
The private key is stored in an accessible location.
Why it's wrong here
The path /etc/ssl/private/ is standard and typically restricted; no indication of misconfiguration.
- ✓
The server does not require client certificates for authentication.
Why this is correct
With ssl_verify_client = optional, clients can skip certificate authentication, weakening mutual authentication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.