CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
An attacker intercepts a TLS-encrypted session and attempts to force the client and server to use a weaker cipher suite. Which type of attack is being performed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Downgrade attack
A downgrade attack tricks the communicating parties into negotiating a less secure version of TLS or a weaker cipher suite, making it easier for the attacker to break the encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Man-in-the-middle (MITM) attack
Why it's wrong here
A Man-in-the-middle (MITM) attack describes a scenario where an attacker secretly intercepts and relays communication between two parties, making them believe they are communicating directly. While a downgrade attack typically requires a MITM position to manipulate the handshake, MITM itself is the broader attack *position* or *strategy*, not the specific *action* of forcing weaker ciphers during a TLS session negotiation.
- ✗
Birthday attack
Why it's wrong here
A Birthday attack is a cryptographic attack that exploits the mathematics behind the birthday problem in probability theory, primarily targeting hash functions. Its goal is to find collisions, where two different inputs produce the same hash output, which can be used to forge digital signatures or bypass integrity checks. This attack is fundamentally unrelated to the active manipulation of TLS cipher suites or protocol versions during a handshake.
- ✗
Replay attack
Why it's wrong here
A Replay attack involves an attacker capturing a valid data transmission and then retransmitting it later to impersonate a legitimate user or repeat an authorized action. This type of attack typically targets authentication mechanisms or transactional integrity by re-sending previously valid messages. The scenario described involves active interference with the TLS handshake to alter encryption parameters, not merely replaying captured data.
- ✓
Downgrade attack
Why this is correct
A Downgrade attack specifically involves an attacker actively manipulating the TLS handshake process between a client and server. The attacker forces the communication parties to negotiate and use an older, less secure protocol version or weaker cipher suite than they would normally prefer or support. This significantly reduces the cryptographic strength of the session, making it easier for the attacker to decrypt intercepted data.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.