CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst notices that a web application's SSL/TLS certificate is issued by a CA that is not trusted by modern browsers. Which type of attack could this enable?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Man-in-the-middle attack
Using a self-signed or untrusted CA certificate can allow an attacker to perform a man-in-the-middle attack by presenting their own certificate that the browser may accept with user warning.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Man-in-the-middle attack
Why this is correct
A Man-in-the-Middle (MITM) attack occurs when an attacker intercepts communication between two parties, impersonating each to the other. If a client is configured to trust an untrusted or compromised Certificate Authority (CA), an attacker can leverage this trust to issue fraudulent SSL/TLS certificates for legitimate domains. This allows the attacker to decrypt, inspect, and re-encrypt traffic, effectively becoming the "man in the middle" without the client's browser raising certificate warnings, thereby compromising confidentiality and integrity.
- ✗
Downgrade attack
Why it's wrong here
A downgrade attack specifically forces a communication protocol to revert to an older, less secure version, such as TLS 1.0 instead of TLS 1.2 or 1.3. This exploitation targets vulnerabilities present in deprecated protocol versions, allowing an attacker to use known exploits against weaker cryptographic algorithms or features. While it compromises security, it does not directly involve the manipulation or trust of Certificate Authorities or the issuance of fake certificates, focusing instead on protocol negotiation.
- ✗
Birthday attack
Why it's wrong here
A birthday attack is a cryptographic attack that exploits the mathematics behind the birthday problem, aiming to find collisions in hash functions. The goal is to find two different inputs that produce the same hash output, which can be used to forge digital signatures or compromise data integrity. This attack primarily targets the strength of hash algorithms themselves, rather than the trust model or issuance process of SSL/TLS certificates or Certificate Authorities.
- ✗
Replay attack
Why it's wrong here
A replay attack involves an attacker intercepting a valid data transmission and then retransmitting it later to impersonate the original sender or to repeat an authorized action. This type of attack typically targets authentication tokens, session cookies, or transaction requests to gain unauthorized access or cause unintended effects. It does not involve forging or manipulating SSL/TLS certificates or compromising the Certificate Authority trust chain, as the attacker merely reuses legitimate, previously captured data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.