Secure Protocols

Question 1 of 6

A security analyst runs a packet capture on the network and opens the results in Wireshark. The capture shows traffic on TCP port 143 where the analyst can clearly read email subject lines, message bodies, and the user’s login credentials in plain text. Which protocol is in use, and what is the secure alternative?

HTTPS on port 143 — it should be replaced with HTTP on port 80 for better compatibility IMAP on port 143 (unencrypted) — the secure alternative is IMAPS on port 993, which wraps the IMAP session in TLS SFTP on port 143 — it should be replaced with FTP on port 21 for standard file transfers SSH on port 143 — the server has been misconfigured to run SSH on a non-standard port

Question 2 of 6

A network administrator types a username and password into a remote device management session. A security auditor later reviews a packet capture taken during that session and sees the credentials in plain text. Which remote access protocol was in use, and which should replace it?

HTTPS — should be replaced with HTTP, which uses port 80 for unencrypted management Telnet — which sends all keystrokes including credentials as plain text; SSH should replace it to encrypt the entire session SFTP — should be replaced with FTP on port 21 to eliminate the plain-text credential issue IMAPS — should be replaced with IMAP on port 143 for standard remote management

Question 3 of 6

A security engineer observes TCP traffic on port 443 destined for a company web server. She assumes the traffic is encrypted. Her colleague runs a packet capture and finds the HTTP headers are fully readable. What does this demonstrate?

Port 443 always guarantees HTTPS encryption; the colleague’s packet capture tool must be malfunctioning A port number indicates the intended service but does not guarantee encryption is active — TLS may not be configured correctly on the server, causing traffic to flow in the clear on port 443 Port 443 uses UDP, not TCP, which is why the encryption failed and headers are visible The traffic is encrypted but the packet capture tool automatically decrypted it for readability

Question 4 of 6

A security researcher at a security conference sets up a passive wireless monitor near the conference registration area, which has an open Wi-Fi access point. What traffic is the researcher able to capture and read?

No traffic — 802.11 wireless networks always encrypt all frames between device and access point regardless of configuration Only traffic on port 80 — all other ports are automatically protected by the 802.11 standard All wireless frames sent by users on that network; any traffic not encrypted at the application layer (HTTP, Telnet, unencrypted email) is fully readable — an open access point provides no transport-level encryption Only management frames — user data frames are always encrypted in 802.11 even without WPA

Question 5 of 6

A remote employee works from various locations including home, hotels, and public Wi-Fi. The company needs all traffic from that employee’s laptop to be encrypted in transit to the corporate network, including traffic from legacy applications that do not support encryption natively. Which solution BEST meets this requirement?

HTTPS — encrypts all traffic from the laptop regardless of the application in use WPA3 — encrypts all traffic between the laptop and the nearest wireless access point, protecting it in transit to the corporate network A VPN client creating an encrypted tunnel from the laptop to a corporate VPN concentrator — all traffic from any application is encrypted inside the tunnel before crossing the untrusted network SSH — creates an encrypted tunnel for all traffic from the laptop to any remote destination server

Question 6 of 6

An organization runs a legacy manufacturing control application that only communicates via FTP (port 21). Replacing it will take 18 months. The security team must reduce the risk of credential and data exposure immediately. Which interim measure BEST addresses the risk without replacing the application?

Change the FTP service to listen on port 443 so that traffic appears to use HTTPS encryption Wrap all FTP sessions in a VPN tunnel — the FTP plaintext is encrypted inside the tunnel, so the network between client and server sees only ciphertext even though the application itself does not encrypt Disable packet capture on the network segment to prevent any monitoring of the FTP traffic Configure the firewall to allow only authenticated users to reach port 21, which will encrypt the FTP data channel

Matching

Match each description to the correct protocol or technology.

1. A wireless security standard that encrypts all traffic between each user device and the access point using per-session keys, preventing nearby attackers from reading captured wireless frames

2. Encrypted web browsing protocol running on TCP port 443 that uses TLS to protect all HTTP request and response data; the secure replacement for plain-text HTTP on port 80

3. A remote console protocol that sends every keystroke — including usernames and passwords — as plain text across the network; visible in full detail in any packet capture

4. An encrypted network-layer tunnel created between a user device and a concentrator that protects all transmitted traffic regardless of which application generates it; covers legacy unencrypted protocols automatically

1. 2. 3. 4.

A. WPA3

B. HTTPS

C. Telnet

D. VPN

Secure Protocols — Quiz

Matching