CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst observes an SSL/TLS handshake where the client and server negotiate TLS 1.0 instead of TLS 1.2, despite the server supporting TLS 1.2. Which attack BEST describes the manipulation of the handshake to force weaker encryption?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Downgrade attack
A downgrade attack occurs when an attacker forces the client and server to negotiate a lower, less secure version of a protocol (e.g., from TLS 1.2 to TLS 1.0) to exploit vulnerabilities in the older version.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Man-in-the-middle attack
Why it's wrong here
A Man-in-the-Middle (MITM) attack involves an adversary secretly relaying and possibly altering the communication between two parties who believe they are directly communicating with each other. While a MITM position is often a prerequisite for executing a downgrade attack, the MITM itself describes the interception and relaying of traffic, not the specific act of manipulating the protocol version negotiation during the SSL/TLS handshake. The core action of forcing a weaker protocol is distinct from merely being in the middle, making MITM a facilitating role rather than the specific attack type described.
- ✗
Replay attack
Why it's wrong here
A replay attack involves an attacker capturing valid data transmissions and maliciously retransmitting them later to impersonate a legitimate user or gain unauthorized access. This type of attack focuses on reusing previously authenticated or authorized messages without modification to the message content or protocol negotiation. It does not involve actively altering the SSL/TLS handshake parameters to force a different protocol version, but rather relies on the re-submission of legitimate, albeit stale, data to achieve its objective.
- ✓
Downgrade attack
Why this is correct
A downgrade attack specifically targets the SSL/TLS handshake process by forcing the communicating parties to negotiate and use an older, weaker, and often vulnerable version of the protocol. During the ClientHello message, an attacker intercepts and modifies the list of supported protocol versions, removing stronger options like TLS 1.2 or 1.3. This manipulation tricks the server into agreeing upon an outdated protocol, such as SSL 3.0 or TLS 1.0, which may contain known cryptographic weaknesses that can then be exploited for decryption or further compromise.
- ✗
Birthday attack
Why it's wrong here
A birthday attack is a cryptographic attack that exploits the mathematical probability of collisions in hash functions, drawing an analogy to the birthday problem. The attacker aims to find two different inputs that produce the same hash output, thereby creating a 'collision' that can be used to forge digital signatures or compromise data integrity. This attack method is entirely unrelated to the process of negotiating or manipulating protocol versions during an SSL/TLS handshake, as it focuses on the properties of hash functions rather than communication protocols.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.