LPIC-2 DNS, Web and Mail Services Practice Question
A company is migrating from Apache HTTPD 2.2 to 2.4 and needs to configure SSL for a virtual host. The administrator wants to use modern security practices. Which of the following configurations is the most secure and recommended for Apache 2.4?
⚠ Common exam trap
Candidates often choose Option B because it explicitly specifies TLS 1.2 and TLS 1.3, which appears modern. However, the cipher suite 'ECDHE+AESGCM' is too restrictive—it only allows ECDHE key exchange and AES-GCM encryption, excluding other secure options like DHE or ChaCha20-Poly1305. While not insecure, it is not the recommended practice for Apache 2.4. Option C uses a more balanced cipher suite (HIGH:!aNULL:!MD5) that provides strong security with broader compatibility, and its protocol setting effectively disables all obsolete versions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSLEngine on; SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1; SSLCipherSuite HIGH:!aNULL:!MD5
It explicitly enables only TLS 1.2 and TLS 1.3 (by disabling SSLv3, TLSv1.0, and TLSv1.1) and uses the HIGH cipher suite with exclusion of aNULL (anonymous NULL ciphers) and MD5 (weak hash). This aligns with modern security standards (e.g., PCI DSS, NIST) and Apache 2.4's recommended hardening practices, avoiding deprecated protocols and weak ciphers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSLEngine on; SSLProtocol -SSLv2 -SSLv3; SSLCipherSuite MEDIUM:!aNULL
Why it's wrong here
Allows TLSv1.0 and TLSv1.1 which are deprecated, and uses MEDIUM ciphers which are weaker.
- ✗
SSLEngine on; SSLProtocol TLSv1.2 TLSv1.3; SSLCipherSuite ECDHE+AESGCM
Why it's wrong here
Overly restrictive and may cause compatibility issues with older but still secure clients.
- ✓
SSLEngine on; SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1; SSLCipherSuite HIGH:!aNULL:!MD5
Why this is correct
Disables all insecure protocols and uses a strong, widely compatible cipher suite.
- ✗
SSLEngine on; SSLProtocol all; SSLCipherSuite DEFAULT
Why it's wrong here
Allows all protocols including insecure ones, and depends on default ciphers which may include weak choices.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.