Exam SY0-501 topic 1 question 626 discussion

CompTIA is a hoax with all these their confusing questions. I hope to pass in my first trial in CompTIA faraday cage I'm in.

I think the answer is actually B. A weak SSL cipher could have been cracked, allowing the attacker to decrypt the contents of the trafficked data. https://www.quora.com/What-are-weak-SSL-ciphers Not sure how this is C at all. The question doesn't refer to an FTP server at all.

FTP - transfer protection = username/password FTP - plain text, non encrypted, the username/password was sniffed off the wire

The answer has to be B the question clearly says exploited data transport protections FTP doesn't have any protection. a weak SSL encryption key may have been used which is then B

After reading a bit of stuff across the net I believe given answer is correct, check this one http://projects.webappsec.org/w/page/13246933/Improper%20Input%20Handling

Ok, read this one, answer is B https://www.veracode.com/security/insufficient-transport-layer-protection

read many comment by can you tell me how the hell do you relate the question asked with anything FTP related? .. I believe it should be B

I will choose B on the exam tomorrow. Here's a website that tells more about protecting against SSL suites weak ciphers: https://beyondsecurity.com/scan-pentest-network-vulnerabilities-ssl-suites-weak-ciphers.html?cn-reloaded=1

These answers are getting ridiculously confusing. I hardly made until here. Topic 1 was so absurd. Topic 2 answers are worse ...

when I look at these questions ... how do ppl even pass this exam?? ill be lucky if it doesnt take me 3 tries..

The question notes "exploited data transport protections". Both 'A' and 'D' are obviously wrong. 'C' mentions improper input handling on an FTP site. FTP isn't secure, so there would have been no data transport protection to exploit at all. (Improper input handling also sounds a lot like lack of input validation - which, again, has nothing to do with data transport protections.) So, the answer must be 'B' - which also makes sense as the sole purpose of SSL is to act as a data transport protection (i.e., encryption). A weak cipher strength could easily be broken, exposing the decrypted data in transport.

SSL encrypts data in transit so SSL

when talking about data transport protection, shouldn't it be SSL?

hint: data in-transit which the only option left is SSL which it secure the data in-transit unlike FTP it secure data at-reset (and don't forget FTP is not secure in the first place)

… Data-in-transit has high requirements for confidentiality. It’s relatively easy for bad guys to intercept transmitting data, so we need good encryption. … (Mike Meyers’ CompTIA Security+ p. 64)

This has to be B SSL is used to protect data

Data transport protection - SSL/TLS