hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A company's security policy requires that all…
A company's security policy requires that all sensitive data be encrypted during transfer. A security administrator discovers that an internal web application is using a self-signed TLS certificate. What vulnerability does this introduce?
⚠ Common exam trap
ISC2 often tests the misconception that self-signed certificates mean TLS is not used, but the trap here is that TLS is still active; the real issue is the lack of certificate validation, which opens the door to MITM attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Man-in-the-middle attacks because the certificate cannot be verified
A self-signed TLS certificate is not signed by a trusted Certificate Authority (CA), so clients cannot verify the certificate's authenticity. This allows an attacker to intercept the TLS handshake, present their own self-signed certificate, and perform a man-in-the-middle (MITM) attack, decrypting and reading or modifying the data in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data corruption
Why it's wrong here
Self-signed certificates do not cause data corruption.
- ✗
Increased latency
Why it's wrong here
Latency is not a security vulnerability introduced by self-signed certificates.
- ✗
Replay attacks because TLS is not used
Why it's wrong here
TLS is used (the certificate is for TLS), so replay attacks are mitigated.
- ✓
Man-in-the-middle attacks because the certificate cannot be verified
Why this is correct
Without a trusted CA, clients cannot confirm the server's identity, allowing interception.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
Key term
Transport Layer Security
Transport Layer Security (TLS) is a cryptographic protocol that provides secure, encrypted communication between two devices over a network, such as between a web browser and a server.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.