easyMultiple ChoiceObjective-mapped
SSCP Practice Question: An e-commerce company runs its web application on…
An e-commerce company runs its web application on a Windows Server 2019 with IIS 10. The security team runs a vulnerability scan and discovers that the server supports TLS 1.0 and several CBC-mode cipher suites, which are prohibited by the company's security policy. The policy requires disabling all versions of TLS below 1.2 and all cipher suites that do not use GCM mode. The administrator needs to implement the required changes without affecting the application's functionality, as it still needs to support a small number of legacy clients that require TLS 1.2 but not CBC. Which action should the administrator take?
⚠ Common exam trap
Test-takers frequently assume a reverse proxy or an OS upgrade is required to enforce strong TLS settings, when in fact Windows Server 2019 fully supports disabling TLS 1.0 and configuring cipher suites natively through registry and IIS settings without additional hardware or software.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable TLS 1.0 via the registry and configure the cipher suite order in IIS to prefer GCM-based ciphers.
The administrator can disable TLS 1.0 via the Windows registry (e.g., by creating the 'Enabled' DWORD under 'HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' and setting it to 0) and then configure the cipher suite order in IIS using the 'SchUseStrongCrypto' registry key or the 'Cipher Suites' group policy to prioritize GCM-based ciphers (e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). This directly enforces the policy—disabling TLS below 1.2 and non-GCM ciphers—while still allowing legacy clients that support TLS 1.2 with GCM to connect without breaking functionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upgrade the server to Windows Server 2022, which automatically disables TLS 1.0.
Why it's wrong here
Upgrading is unnecessary; the current OS can be configured.
- ✗
Implement a reverse proxy with strong TLS configuration and route all traffic through it.
Why it's wrong here
This adds complexity and may not be needed if the server can be configured directly.
- ✓
Disable TLS 1.0 via the registry and configure the cipher suite order in IIS to prefer GCM-based ciphers.
Why this is correct
This directly implements the policy and only affects prohibited protocols and ciphers.
- ✗
Apply a hotfix from Microsoft that removes TLS 1.0 support.
Why it's wrong here
No such hotfix is required; TLS 1.0 can be disabled manually.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.