CND Application And Data Protection Practice Question
A developer is configuring TLS 1.3 encryption on an Nginx web server. To ensure maximum cryptographic strength and forward secrecy, which cipher suite configuration should be specified for TLS 1.3?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ssl_protocols TLSv1.3; and relying on the protocol's mandated secure cipher suites (e.g., TLS_AES_256_GCM_SHA384)
TLS 1.3 cipher suites are predefined by the protocol standard (RFC 8446) and do not allow cipher suite negotiation in the same manner as TLS 1.2. The directive ssl_ciphers applies to TLS 1.2, whereas TLS 1.3 ciphers are controlled via ssl_conf_command or default built-in parameters like TLS_AES_256_GCM_SHA384.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
Why it's wrong here
This syntax configures cipher suites specifically for TLS 1.2 and earlier, not TLS 1.3.
- ✓
ssl_protocols TLSv1.3; and relying on the protocol's mandated secure cipher suites (e.g., TLS_AES_256_GCM_SHA384)
Why this is correct
TLS 1.3 eliminates vulnerable legacy ciphers entirely and mandates secure AEAD ciphers automatically when TLSv1.3 is enabled.
- ✗
ssl_prefer_server_ciphers off; combined with MD5
Why it's wrong here
MD5 is cryptographically broken and never used in modern secure TLS configurations.
- ✗
ssl_cipher_suites 'TLS_RSA_WITH_AES_128_CBC_SHA';
Why it's wrong here
This is an insecure legacy cipher suite and is explicitly prohibited in TLS 1.3.
About these practice questions
One of 323 original CND practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.