MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. SSL stripping is best described as what type of attack?
   a. Denial of Service
   b. SQL Injection
   c. Man-in-the-Middle
   d. Phishing
   Answer: c. Man-in-the-Middlecheckpoint+1​
2. What is the main goal of SSL stripping?
   a. Encrypt data communication
   b. Downgrade HTTPS to HTTP
   c. Strengthen SSL certificates
   d. Block HTTP communication
   Answer: b. Downgrade HTTPS to HTTPexamradar+1​
3. Who introduced the concept of SSL stripping in a 2009 presentation?
   a. Kevin Mitnick
   b. Moxie Marlinspike
   c. Robert Hansen
   d. Bruce Schneier
   Answer: b. Moxie Marlinspikecyberark​
4. SSL stripping primarily targets which type of web traffic?
   a. Encrypted HTTPS connections
   b. Plaintext Telnet sessions
   c. FTP transfers
   d. DNS lookups
   Answer: a. Encrypted HTTPS connectionskeyfactor+1​
5. Which protocol does SSL stripping force clients to use instead of HTTPS?
   a. FTPS
   b. SMTP
   c. HTTP
   d. SFTP
   Answer: c. HTTPcheckpoint+1​
6. In an SSL stripping attack, the attacker acts as a bridge between:
   a. DNS server and browser
   b. Web server and browser
   c. Firewall and router
   d. Switch and hub
   Answer: b. Web server and browsercyberark​
7. SSL stripping is also known as a(n):
   a. SSL downgrade attack
   b. SQL downgrade attack
   c. HTTPS injection
   d. HTTP bridging
   Answer: a. SSL downgrade attackentro+1​
8. Which of the following is the primary method used to intercept traffic in SSL stripping?
   a. ARP spoofing
   b. Buffer overflow
   c. Cross-site scripting
   d. SQL injection
   Answer: a. ARP spoofingkeyfactor​
9. What is the biggest risk of SSL stripping?
   a. Data loss
   b. Plaintext data exposure
   c. Network unavailability
   d. DNS hijacking
   Answer: b. Plaintext data exposuretwingate+1​
10. Which symbol typically indicates a secure HTTPS connection in browsers?
    a. Lock icon
    b. Shield icon
    c. Globe
    d. Warning triangle
    Answer: a. Lock iconssldragon​
11. Which of these is a common environment for SSL stripping attacks?
    a. Secure corporate intranet
    b. Public Wi-Fi networks
    c. Cellular data connection
    d. Private VPN
    Answer: b. Public Wi-Fi networkstwingate+1​
12. What allows attackers to replace SSL certificates with their own in SSL stripping?
    a. DNS caching
    b. MitM positioning
    c. Packet filtering
    d. Port mirroring
    Answer: b. MitM positioningcyberark​
13. The major purpose of HSTS is to:
    a. Force browsers to use HTTPS
    b. Disable SSL 3.0
    c. Allow HTTP redirection
    d. Cache SSL certificates
    Answer: a. Force browsers to use HTTPSexpressvpn+1​
14. What does HSTS stand for?
    a. HTTPS Secure Transmission Standard
    b. HTTP Secure Transport Service
    c. HTTP Strict Transport Security
    d. HyperText Security System
    Answer: c. HTTP Strict Transport Securityexpressvpn​
15. Which browser action helps prevent SSL stripping?
    a. Checking for padlock icons
    b. Disabling pop-ups
    c. Clearing cookies
    d. Using incognito mode
    Answer: a. Checking for padlock iconsssldragon​
16. What is the role of certificate pinning in defending against SSL stripping?
    a. Allows dynamic site pinning
    b. Verifies fixed SSL certificates
    c. Encrypts HTTP headers
    d. Monitors browsing history
    Answer: b. Verifies fixed SSL certificatescheapsslweb+1​
17. How does certificate pinning work?
    a. Random key generation
    b. Matching specific SSL certificate public keys
    c. DNS-level validation
    d. Password-based encryption
    Answer: b. Matching specific SSL certificate public keyssectigostore​
18. SSL stripping usually begins when a user connects via:
    a. HTTPS localhost
    b. Initial HTTP connection
    c. VPN tunnel
    d. SSL proxy
    Answer: b. Initial HTTP connectionkeyfactor​
19. What immediate indication may show SSL stripping in progress?
    a. Redirect delays
    b. Lack of HTTPS padlock
    c. Slow download
    d. Browser crash
    Answer: b. Lack of HTTPS padlockssldragon​
20. What is the fundamental weakness SSL stripping exploits?
    a. HTTP to HTTPS redirection
    b. Cookie handling
    c. Firewall bypassing
    d. Browser storage
    Answer: a. HTTP to HTTPS redirectioncyberark​
21. What happens to user data after SSL stripping?
    a. It becomes unreadable
    b. It is transmitted in plaintext
    c. It is RSA-encrypted
    d. It is sandboxed locally
    Answer: b. It is transmitted in plaintextkeyfactor+1​
22. Which attack class does SSL stripping belong to?
    a. DoS
    b. Brute-force
    c. Man-in-the-Middle
    d. Exploit chaining
    Answer: c. Man-in-the-Middleentro+1​
23. Which of these protocols is vulnerable to downgrade in SSL stripping?
    a. SSH
    b. HTTPS
    c. SNMPv3
    d. TLS 1.3
    Answer: b. HTTPScheckpoint​
24. SSL stripping can trick:
    a. Both browser and server
    b. Only the browser
    c. Only the server
    d. Only the DNS resolver
    Answer: a. Both browser and servercyberark​
25. What kind of encryption does SSL stripping eliminate?
    a. Symmetric encryption
    b. Asymmetric encryption
    c. SSL/TLS encryption
    d. End-to-end email encryption
    Answer: c. SSL/TLS encryptioncheckpoint​
26. Which configuration failure makes SSL stripping easier?
    a. Weak cipher suite
    b. Incorrect DNS
    c. HSTS misconfiguration
    d. Port forwarding errors
    Answer: c. HSTS misconfigurationssldragon​
27. Enabling HSTS prevents what?
    a. Session hijacking
    b. HTTP downgrade
    c. Cookie theft
    d. Port scanning
    Answer: b. HTTP downgradeexpressvpn​
28. Which preloaded mechanism protects sites from SSL stripping even before first visit?
    a. DNSSEC
    b. HSTS preload list
    c. HTTP headers
    d. TLS handshake
    Answer: b. HSTS preload listexpressvpn​
29. Which tool was famously demonstrated to automate SSL stripping attacks?
    a. Ettercap
    b. SSLstrip
    c. Hydra
    d. Cain & Abel
    Answer: b. SSLstripcyberark​
30. The SSL stripping attack relies on an unencrypted link between:
    a. Victim and attacker
    b. Attacker and DNS
    c. Server and firewall
    d. Router and ISP
    Answer: a. Victim and attackercyberark​
31. What HTTP header enforces HTTPS connections to prevent SSL stripping?
    a. Content-Security-Policy
    b. Strict-Transport-Security
    c. X-Frame-Options
    d. Authorization
    Answer: b. Strict-Transport-Securityssldragon​
32. SSL stripping can be mitigated by:
    a. Using VPN encryption
    b. Enabling cookies
    c. Increasing router hops
    d. Disabling firewalls
    Answer: a. Using VPN encryptionencryptionconsulting​
33. Which indicator confirms a page is not SSL stripped?
    a. URL starts with HTTPS
    b. URL starts with HTTP
    c. Missing favicon
    d. Page loads instantly
    Answer: a. URL starts with HTTPScheckpoint​
34. What role does ARP spoofing play in SSL stripping?
    a. Stops server responses
    b. Redirects traffic to attacker
    c. Encrypts user passwords
    d. Validates SSL handshake
    Answer: b. Redirects traffic to attackerkeyfactor​
35. Which outdated SSL protocol versions increase attack risk?
    a. TLS 1.2
    b. SSLv2 and SSLv3
    c. SSHv2
    d. HTTPS 2.0
    Answer: b. SSLv2 and SSLv3ssldragon​
36. Which is a real-world scenario of SSL stripping?
    a. Intercepted traffic on public Wi-Fi
    b. Email spam filtering
    c. DNS cache poisoning
    d. TCP flooding
    Answer: a. Intercepted traffic on public Wi-Fitwingate+1​
37. Which software configuration ensures HTTPS use sitewide?
    a. HTTPS redirection
    b. HTTPS fallback
    c. HTTP mirroring
    d. DNS proxy forwarding
    Answer: a. HTTPS redirectionexpressvpn+1​
38. What should users look for to verify SSL status?
    a. HTTPS and padlock icon
    b. IP address
    c. File size
    d. Server uptime
    Answer: a. HTTPS and padlock iconssldragon​
39. Certificate expiration might indirectly increase risk of:
    a. SSL stripping
    b. Brute-force
    c. SQL injection
    d. Load balancing
    Answer: a. SSL strippingssldragon​
40. Training users about HTTPS awareness helps prevent:
    a. Spam attacks
    b. SSL stripping
    c. Virus infections
    d. Software piracy
    Answer: b. SSL strippingssldragon​
41. What data is most at risk during SSL stripping?
    a. Encrypted DNS records
    b. Plaintext passwords and credentials
    c. Encrypted cloud storage files
    d. Compressed logs
    Answer: b. Plaintext passwords and credentialstwingate​
42. Which method enables long-term browser-level SSL enforcement?
    a. HSTS preload
    b. Manual DNS entry
    c. Browser caching
    d. TLS fallback
    Answer: a. HSTS preloadexpressvpn​
43. SSL stripping primarily targets which phase of connection?
    a. Protocol transition phase
    b. Post-handshake phase
    c. Data encapsulation phase
    d. Server closing phase
    Answer: a. Protocol transition phasecyberark​
44. SSL stripping is typically used to steal:
    a. User credentials
    b. MAC addresses
    c. SSL certificates
    d. Token hashes
    Answer: a. User credentialstwingate+1​
45. Which defense measure disables weak SSL protocols?
    a. Secure HTTPS configuration
    b. Cookie encryption
    c. Firewall rules
    d. DNS encryption
    Answer: a. Secure HTTPS configurationssldragon​
46. What ensures browsers don’t revert to HTTP after seeing HTTPS?
    a. HTTP Strict Transport Security
    b. SSL termination
    c. Load balancing
    d. DNSSEC caching
    Answer: a. HTTP Strict Transport Securityexpressvpn​
47. Why is public Wi-Fi dangerous for SSL stripping?
    a. No user authentication
    b. Shared encryption keys
    c. Open access to all users
    d. All of the above
    Answer: d. All of the abovekeyfactor+1​
48. SSL stripping attacks can lead to:
    a. Credential theft
    b. Financial fraud
    c. Data breaches
    d. All of the above
    Answer: d. All of the abovetwingate+1​
49. Certificate pinning ensures:
    a. SSL certificates cannot be replaced by attackers
    b. Users can disable HTTPS
    c. Faster web connections
    d. Load balancing is enabled
    Answer: a. SSL certificates cannot be replaced by attackerscheapsslweb+1​
50. One of the simplest user defenses against SSL stripping is:
    a. Verifying HTTPS before entering credentials
    b. Disabling the antivirus
    c. Clearing cookies frequently
    d. Using non-secure browsers
    Answer: a. Verifying HTTPS before entering credentialsexpressvpn+1​

1. https://www.checkpoint.com/cyber-hub/cyber-security/what-is-cyber-attack/what-is-an-ssl-stripping-attack/
2. https://www.cyberark.com/what-is/ssl-stripping-attacks/
3. https://examradar.com/question/13036/What-is-the-primary-purpose-of-an-SSL-Stripping-attack-in-the-context-of-MITM-attacks/
4. https://www.keyfactor.com/blog/what-are-ssl-stripping-attacks/
5. https://entro.security/glossary/ssl-stripping-attacks/
6. https://www.twingate.com/blog/glossary/ssl%20stripping
7. https://www.ssldragon.com/blog/ssl-stripping/
8. https://www.expressvpn.com/blog/what-is-ssl-stripping-attack/
9. https://cheapsslweb.com/blog/what-is-ssl-stripping/
10. https://sectigostore.com/blog/putting-ssl-certificate-pinning-into-laymans-terms/
11. https://www.encryptionconsulting.com/detailed-guide-to-preventing-ssl-stripping/
12. https://examradar.com/man-in-the-middle-mitm-attacks-mcqs-multiple-choice-questions-with-answers/
13. https://www.sanfoundry.com/network-security-mcqs/
14. https://www.scribd.com/document/576915038/Introduction-to-Cybersecurity-Assessment
15. https://www.scribd.com/document/516169743/Cyber-Security-MCQ-Set-1-5
16. https://www.ourcreativeinfo.in/cyber-security-mcq/
17. https://www.sectigo.com/resource-library/what-is-an-ssl-stripping-attack
18. https://www.reddit.com/r/bugbounty/comments/17vkw4a/is_missing_ssl_best_practices_and_a_completely/
19. https://www.studocu.com/in/document/maa-shakumbhari-university/bachelor-of-computer-application/ns-mcq-network-security-multiple-choice-questions-for-exam-prep/129450495
20. https://www.invicti.com/learn/mitm-ssl-stripping