Study. uk . com
  1. Home
  2. All questions
  3. Question 486

CompTIA Security+ study material · question 486 of 611

Why is disabling old TLS versions on the server necessary rather than merely deprioritising them?

  1. Old versions cannot present certificates
  2. Old versions consume more CPU
  3. A client will negotiate whatever the server still offers, so an attacker can force a downgrade
  4. Deprioritising breaks session resumption
Show the answer

Answer: C. A client will negotiate whatever the server still offers, so an attacker can force a downgrade

Preference order does not stop negotiation; only removing the option closes the downgrade path.

Source: OWASP Transport Layer Security Cheat Sheet (OWASP) — OWASP Transport Layer Security Cheat Sheet › Server Configuration

Challenge yourself on this topic → Study as cards