LPIC-2 System Security Practice Question
Your company runs a web application on a Linux server that uses Apache HTTPD with mod_ssl for HTTPS. Recently, after a security audit, it was discovered that the server is vulnerable to the POODLE attack on SSLv3. The server is running RHEL 8 with Apache 2.4. The SSL configuration file /etc/httpd/conf.d/ssl.conf currently has the line 'SSLProtocol all -SSLv2'. You need to disable SSLv3 and also disable all versions of TLS below 1.2, while still allowing TLS 1.2 and 1.3. The server must remain available immediately. Which action should you take?
⚠ Common exam trap
Many exam-takers think adding '-SSLv3' to the existing line (Option A) is sufficient, but they overlook the requirement to also disable TLS 1.0 and TLS 1.1, which remain enabled by the 'all' macro and are still vulnerable to downgrade attacks like BEAST or Lucky13.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change 'SSLProtocol all -SSLv2' to 'SSLProtocol TLSv1.2 TLSv1.3'
The directive 'SSLProtocol TLSv1.2 TLSv1.3' explicitly enables only TLS 1.2 and TLS 1.3, thereby disabling SSLv3 and all TLS versions below 1.2 (i.e., TLS 1.0 and TLS 1.1). This directly addresses the POODLE vulnerability (which exploits SSLv3) and enforces the required minimum TLS version, while keeping the server immediately available without restarting Apache (a graceful reload is sufficient).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change 'SSLProtocol all -SSLv2' to 'SSLProtocol all -SSLv2 -SSLv3'
Why it's wrong here
This disables SSLv3 but still allows TLS 1.0 and 1.1, which are deprecated.
- ✗
Add 'SSLProtocol -SSLv3' after the existing line
Why it's wrong here
The second line would override? Actually Apache uses last occurrence, but this might cause conflicts; still allows TLS 1.0/1.1.
- ✓
Change 'SSLProtocol all -SSLv2' to 'SSLProtocol TLSv1.2 TLSv1.3'
Why this is correct
This explicitly enables only TLS 1.2 and 1.3, disabling all older protocols.
- ✗
Change the line to 'SSLProtocol TLSv1.2 TLSv1.3 -SSLv2 -SSLv3'
Why it's wrong here
Redundant: the minus options are unnecessary if you explicitly list the allowed protocols. This would still work but is not standard.
Go deeper
Related to this question
About these practice questions
One of 507 original LPIC-2 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.