CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security engineer observes the following log event: 'Certificate for www.example.com was issued by an intermediate CA that chains to a root CA not in the trusted store.' Which type of attack might this indicate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Man-in-the-middle using a rogue certificate
A certificate from an untrusted root CA suggests a rogue or misissued certificate, possibly from a malicious CA or a man-in-the-middle attack using a proxy with its own CA certificate not trusted by the client.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Birthday attack on the certificate signature
Why it's wrong here
A Birthday attack primarily exploits the mathematical probability of finding hash collisions, where two different inputs produce the same hash output. While such an attack could theoretically be used to forge a certificate signature if an attacker could trick a CA, an "untrusted root CA" log event specifically indicates a failure in the Public Key Infrastructure (PKI) trust chain validation. This error means the certificate's issuing authority is not recognized or trusted by the client, rather than a cryptographic collision compromising the signature's integrity.
- ✗
Downgrade attack to SSLv3
Why it's wrong here
A downgrade attack specifically targets the negotiation phase of a TLS/SSL handshake, forcing the client and server to communicate using an older, less secure protocol version, such as SSLv3 instead of modern TLS. This type of attack aims to exploit vulnerabilities present in deprecated protocols. However, an "untrusted root CA" error directly pertains to the cryptographic validity and trustworthiness of the server's digital certificate within the PKI, not the version of the secure communication protocol being used.
- ✓
Man-in-the-middle using a rogue certificate
Why this is correct
When a client encounters an "untrusted root CA" error, it signifies that the digital certificate presented by the server cannot be validated against the client's pre-installed list of trusted Certificate Authorities. In a Man-in-the-Middle (MitM) attack, an adversary intercepts communication and presents a fraudulent certificate, often self-signed or issued by an attacker-controlled CA, to the client. This rogue certificate will naturally fail the trust chain validation, leading to the observed error as the client cannot establish a secure, authenticated connection to the legitimate server.
- ✗
Replay attack on the TLS handshake
Why it's wrong here
A replay attack involves an attacker capturing legitimate data packets, such as a TLS handshake or application data, and then retransmitting them at a later time to impersonate a legitimate party or trigger an unauthorized action. Modern TLS protocols incorporate mechanisms like nonces and sequence numbers to prevent such attacks by ensuring session uniqueness. An "untrusted root CA" error, however, is a fundamental failure in verifying the authenticity and integrity of the server's identity through its digital certificate, not a concern related to the reuse of past communication data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.