hardMultiple ChoiceObjective-mapped
SSCP Practice Question: A mid-sized company has deployed a web…
A mid-sized company has deployed a web application that handles sensitive customer data. The application uses TLS to encrypt data in transit. Recently, the company received a penetration test report indicating that an attacker could potentially downgrade the TLS connection to an older, weaker version (e.g., TLS 1.0) by performing a man-in-the-middle attack. The application server runs on Windows Server 2022 with IIS 10. The security team wants to disable all versions of TLS below 1.2 on the server. However, after making registry changes to disable TLS 1.0 and 1.1, some legacy clients that only support TLS 1.0 are unable to connect. The business requires that these legacy clients still be able to access the application securely, but the security team insists on disabling weak protocols. The server currently has a valid certificate from a public CA. Which of the following is the most appropriate course of action?
⚠ Common exam trap
Candidates often think re-enabling weak protocols (Option D) is the only way to support legacy clients, or that upgrading clients (Option B) is always feasible, but the exam expects you to recognize that a reverse proxy provides a secure, practical compromise without weakening the server's security posture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a TLS-terminating reverse proxy that supports both strong and legacy TLS, placing it in front of the web server.
Deploying a TLS-terminating reverse proxy allows the server to enforce TLS 1.2+ on the backend while the proxy handles legacy TLS 1.0 connections from older clients. This satisfies both the security requirement to disable weak protocols on the origin server and the business need to support legacy clients, without exposing the server to downgrade attacks. The proxy can be configured with separate TLS policies per listener, ensuring that only the proxy accepts weaker TLS versions while the IIS server remains locked down.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Switch the application to use a VPN instead of TLS for legacy client access.
Why it's wrong here
VPNs add complexity and may not address the legacy TLS requirement; also, downgrade attacks may still be possible.
- ✗
Upgrade all legacy clients to support TLS 1.2 or later immediately.
Why it's wrong here
Upgrading clients may be impractical or impossible in the short term.
- ✓
Deploy a TLS-terminating reverse proxy that supports both strong and legacy TLS, placing it in front of the web server.
Why this is correct
The proxy can negotiate strong TLS with the server and weaker TLS with legacy clients, isolating the server from weak protocols.
- ✗
Re-enable TLS 1.0 and 1.1 on the server, as the business requirement outweighs security concerns.
Why it's wrong here
Re-enabling weak protocols exposes the server to downgrade attacks and violates security policy.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.