hardMultiple Choice
ISC2 CC Practice Question: A company's security policy requires that all…
A company's security policy requires that all sensitive data be encrypted during transfer. A security administrator discovers that an internal web application is using a self-signed TLS certificate. What vulnerability does this introduce?
⚠ Common exam trap
ISC2 often tests the misconception that self-signed certificates mean TLS is not used, but the trap here is that TLS is still active; the real issue is the lack of certificate validation, which opens the door to MITM attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Man-in-the-middle attacks because the certificate cannot be verified
A self-signed TLS certificate is not signed by a trusted Certificate Authority (CA), so clients cannot verify the certificate's authenticity. This allows an attacker to intercept the TLS handshake, present their own self-signed certificate, and perform a man-in-the-middle (MITM) attack, decrypting and reading or modifying the data in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data corruption
Why it's wrong here
A self-signed certificate causes clients to reject or distrust the TLS connection, exposing users to man-in-the-middle interception; it does not corrupt data. It is tempting because untrusted certificates are often bypassed, but the actual vulnerability is loss of authentication and integrity, not corruption.
- ✗
Increased latency
Why it's wrong here
Certificate trust has no bearing on network round-trip time, so latency is unaffected by whether a certificate is self-signed or CA-issued. Increased latency would stem from factors such as geographic distance, routing, or processing overhead, not certificate provenance.
- ✗
Replay attacks because TLS is not used
Why it's wrong here
TLS is in fact used; the certificate is merely self-signed, so transport encryption still occurs and replay attacks are not introduced by that. Self-signed certificates raise trust and validation concerns, such as browser warnings or man-in-the-middle exposure, not the absence of TLS.
- ✓
Man-in-the-middle attacks because the certificate cannot be verified
Why this is correct
Self-signed certificates lack a trusted certification authority signature, so clients cannot validate the server's identity against a trusted chain. This allows an attacker to intercept and decrypt traffic by presenting their own certificate, directly violating the policy requirement that sensitive data be encrypted during transfer.
Go deeper
Related to this question
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
Key term
Transport Layer Security
Transport Layer Security (TLS) is a cryptographic protocol that provides secure, encrypted communication between two devices over a network, such as between a web browser and a server.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.