Cryptographic Protocol Vocabulary Quiz
Learn cryptographic protocol vocabulary: TLS 1.2 vs 1.3, cipher suites, perfect forward secrecy, certificate pinning, and enforcing minimum TLS versions.
0 / 23 completed
1 / 23
What is a key security improvement of TLS 1.3 over TLS 1.2?
TLS 1.3 mandates PFS (no RSA key exchange), removes vulnerable options (RC4, 3DES, SHA-1, MD5), and reduces the handshake to 1-RTT (or even 0-RTT for resumption). These changes eliminate entire classes of past TLS attacks.
2 / 23
What is a 'cipher suite' in a TLS configuration?
A cipher suite is a set of algorithms that defines how a TLS connection will be secured: how keys are exchanged (ECDHE), how the server authenticates (RSA/ECDSA), what symmetric cipher encrypts data (AES-256-GCM), and what hash function provides integrity (SHA-384).
3 / 23
What is 'perfect forward secrecy' (PFS)?
With PFS, session keys are derived from ephemeral (one-time) key exchanges. If an attacker later obtains the server's private key, they still cannot decrypt previously captured TLS sessions because the session keys were never stored.
4 / 23
What is 'certificate pinning' and what risk does it mitigate?
Certificate pinning protects against rogue CA attacks: even if an attacker obtains a fraudulently issued certificate from a trusted CA, a pinned client rejects it because it doesn't match the pinned certificate/key. Used in high-security mobile apps.
5 / 23
A security policy says 'we enforce TLS 1.3 minimum'. What does this mean operationally?
Enforcing a minimum TLS version means configuring servers to reject connections that negotiate lower versions. This is done in web server config (Nginx: ssl_protocols TLSv1.3; Apache: SSLProtocol TLSv1.3), load balancers, and CDN settings.
6 / 23
Reviewer: 'I'm seeing a lot of `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` cipher suite being used in the API endpoint. It's quite old and lacks modern protections against downgrade attacks. Are you sure we're not vulnerable here? PR Description: 'We've implemented a new secure protocol to ensure data integrity.'
Which of the following best describes the reviewer's concern?The reviewer is rightly concerned about the age of `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`. Older cipher suites are more vulnerable to downgrade attacks because they may not fully support modern TLS features like forward secrecy or robust authentication.
While newer cipher suites *are* generally preferable, the core issue here is the potential for exploitation due to the suite's legacy. Selecting a secure cipher suite isn't just about performance; it's fundamentally about mitigating known vulnerabilities and ensuring long-term security.
While newer cipher suites *are* generally preferable, the core issue here is the potential for exploitation due to the suite's legacy. Selecting a secure cipher suite isn't just about performance; it's fundamentally about mitigating known vulnerabilities and ensuring long-term security.
7 / 23
Sarah: 'Hey team, just ran a quick audit of our API traffic. I'm seeing a significant number of requests still using the TLS_DHE_RSA_WITH_AES_128_CBC_SHA cipher suite. Given our recent push to improve security posture and comply with upcoming regulations, is this something we should investigate further? It's flagged as a potential weak point.' Which of the following best captures
Sarah's primary concern?Sarah's concern isn't about latency or authentication (though those could be secondary issues). The core problem lies in the cipher suite itself. TLS_DHE_RSA_WITH_AES_128_CBC_SHA is an older protocol that has known vulnerabilities – specifically, it lacks modern protections like forward secrecy and offers weaker encryption algorithms compared to more recent standards. Choosing a less secure cipher suite significantly increases the risk of compromise, making it a priority for remediation.8 / 23
During a Slack discussion about securing our new payment API, Liam posted: 'Just noticed we're still using `TLS_RSA_WITH_AES_256_CBC_SHA`. Seems pretty outdated. Are we sure this isn't a risk?'. Considering the context and Liam's phrasing, what is he primarily highlighting?
Slack Message: 'Just noticed we're still using TLS_RSA_WITH_AES_256_CBC_SHA. Seems pretty outdated. Are we sure this isn't a risk?'
The correct answer highlights Liam's concern regarding the lack of modern protections within the
TLS_RSA_WITH_AES_256_CBC_SHA cipher suite. This particular configuration is vulnerable to attacks that exploit weaknesses in its design, specifically lacking features like Perfect Forward Secrecy (PFS) which would protect past communications even if the server's private key were compromised. The other options misinterpret Liam's statement – he isn't focused on performance or a misunderstanding of cipher suites; rather, he is directly pointing out a security risk.9 / 23
Reviewer: 'I'm seeing a lot of `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` cipher suite being used in the API endpoint. It's quite old and lacks modern protections against downgrade attacks. Are you sure we're not vulnerable here? PR Description: 'We've implemented a new secure protocol to ensure data integrity.'
Which of the following best describes the reviewer's concern?The reviewer is rightly concerned about the age of `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`. Older cipher suites are more vulnerable to downgrade attacks because they may not fully support modern TLS features like forward secrecy or robust authentication.
While newer cipher suites *are* generally preferable, the core issue here is the potential for exploitation due to the suite's legacy. Selecting a secure cipher suite isn't just about performance; it's fundamentally about mitigating known vulnerabilities and ensuring long-term security.
While newer cipher suites *are* generally preferable, the core issue here is the potential for exploitation due to the suite's legacy. Selecting a secure cipher suite isn't just about performance; it's fundamentally about mitigating known vulnerabilities and ensuring long-term security.
10 / 23
Sarah: 'Hey team, just ran a quick audit of our API traffic. I'm seeing a significant number of requests still using the TLS_DHE_RSA_WITH_AES_128_CBC_SHA cipher suite. Given our recent push to improve security posture and comply with upcoming regulations, is this something we should investigate further? It's flagged as a potential weak point.' Which of the following best captures
Sarah's primary concern?Sarah's concern isn't about latency or authentication (though those could be secondary issues). The core problem lies in the cipher suite itself. TLS_DHE_RSA_WITH_AES_128_CBC_SHA is an older protocol that has known vulnerabilities – specifically, it lacks modern protections like forward secrecy and offers weaker encryption algorithms compared to more recent standards. Choosing a less secure cipher suite significantly increases the risk of compromise, making it a priority for remediation.11 / 23
During a Slack discussion about securing our new payment API, Liam posted: 'Just noticed we're still using `TLS_RSA_WITH_AES_256_CBC_SHA`. Seems pretty outdated. Are we sure this isn't a risk?'. Considering the context and Liam's phrasing, what is he primarily highlighting?
Slack Message: 'Just noticed we're still using TLS_RSA_WITH_AES_256_CBC_SHA. Seems pretty outdated. Are we sure this isn't a risk?'
The correct answer highlights Liam's concern regarding the lack of modern protections within the
TLS_RSA_WITH_AES_256_CBC_SHA cipher suite. This particular configuration is vulnerable to attacks that exploit weaknesses in its design, specifically lacking features like Perfect Forward Secrecy (PFS) which would protect past communications even if the server's private key were compromised. The other options misinterpret Liam's statement – he isn't focused on performance or a misunderstanding of cipher suites; rather, he is directly pointing out a security risk.12 / 23
Reviewer: 'I'm seeing a lot of `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` cipher suite being used in the API endpoint. It's quite old and lacks modern protections against downgrade attacks. Are you sure we're not vulnerable here? PR Description: 'We've implemented a new secure protocol to ensure data integrity.'
Which of the following best describes the reviewer's concern?The reviewer is rightly concerned about the age of `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`. Older cipher suites are more vulnerable to downgrade attacks because they may not fully support modern TLS features like forward secrecy or robust authentication.
While newer cipher suites *are* generally preferable, the core issue here is the potential for exploitation due to the suite's legacy. Selecting a secure cipher suite isn't just about performance; it's fundamentally about mitigating known vulnerabilities and ensuring long-term security.
While newer cipher suites *are* generally preferable, the core issue here is the potential for exploitation due to the suite's legacy. Selecting a secure cipher suite isn't just about performance; it's fundamentally about mitigating known vulnerabilities and ensuring long-term security.
13 / 23
Sarah: 'Hey team, just ran a quick audit of our API traffic. I'm seeing a significant number of requests still using the TLS_DHE_RSA_WITH_AES_128_CBC_SHA cipher suite. Given our recent push to improve security posture and comply with upcoming regulations, is this something we should investigate further? It's flagged as a potential weak point.' Which of the following best captures
Sarah's primary concern?Sarah's concern isn't about latency or authentication (though those could be secondary issues). The core problem lies in the cipher suite itself. TLS_DHE_RSA_WITH_AES_128_CBC_SHA is an older protocol that has known vulnerabilities – specifically, it lacks modern protections like forward secrecy and offers weaker encryption algorithms compared to more recent standards. Choosing a less secure cipher suite significantly increases the risk of compromise, making it a priority for remediation.14 / 23
During a Slack discussion about securing our new payment API, Liam posted: 'Just noticed we're still using `TLS_RSA_WITH_AES_256_CBC_SHA`. Seems pretty outdated. Are we sure this isn't a risk?'. Considering the context and Liam's phrasing, what is he primarily highlighting?
Slack Message: 'Just noticed we're still using TLS_RSA_WITH_AES_256_CBC_SHA. Seems pretty outdated. Are we sure this isn't a risk?'
The correct answer highlights Liam's concern regarding the lack of modern protections within the
TLS_RSA_WITH_AES_256_CBC_SHA cipher suite. This particular configuration is vulnerable to attacks that exploit weaknesses in its design, specifically lacking features like Perfect Forward Secrecy (PFS) which would protect past communications even if the server's private key were compromised. The other options misinterpret Liam's statement – he isn't focused on performance or a misunderstanding of cipher suites; rather, he is directly pointing out a security risk.15 / 23
Reviewer: 'I'm seeing a lot of `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` cipher suite being used in the API endpoint. It's quite old and lacks modern protections against downgrade attacks. Are you sure we're not vulnerable here? PR Description: 'We've implemented a new secure protocol to ensure data integrity.'
Which of the following best describes the reviewer's concern?The reviewer is rightly concerned about the age of `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`. Older cipher suites are more vulnerable to downgrade attacks because they may not fully support modern TLS features like forward secrecy or robust authentication.
While newer cipher suites *are* generally preferable, the core issue here is the potential for exploitation due to the suite's legacy. Selecting a secure cipher suite isn't just about performance; it's fundamentally about mitigating known vulnerabilities and ensuring long-term security.
While newer cipher suites *are* generally preferable, the core issue here is the potential for exploitation due to the suite's legacy. Selecting a secure cipher suite isn't just about performance; it's fundamentally about mitigating known vulnerabilities and ensuring long-term security.
16 / 23
Sarah: 'Hey team, just ran a quick audit of our API traffic. I'm seeing a significant number of requests still using the TLS_DHE_RSA_WITH_AES_128_CBC_SHA cipher suite. Given our recent push to improve security posture and comply with upcoming regulations, is this something we should investigate further? It's flagged as a potential weak point.' Which of the following best captures
Sarah's primary concern?Sarah's concern isn't about latency or authentication (though those could be secondary issues). The core problem lies in the cipher suite itself. TLS_DHE_RSA_WITH_AES_128_CBC_SHA is an older protocol that has known vulnerabilities – specifically, it lacks modern protections like forward secrecy and offers weaker encryption algorithms compared to more recent standards. Choosing a less secure cipher suite significantly increases the risk of compromise, making it a priority for remediation.17 / 23
During a Slack discussion about securing our new payment API, Liam posted: 'Just noticed we're still using `TLS_RSA_WITH_AES_256_CBC_SHA`. Seems pretty outdated. Are we sure this isn't a risk?'. Considering the context and Liam's phrasing, what is he primarily highlighting?
Slack Message: 'Just noticed we're still using TLS_RSA_WITH_AES_256_CBC_SHA. Seems pretty outdated. Are we sure this isn't a risk?'
The correct answer highlights Liam's concern regarding the lack of modern protections within the
TLS_RSA_WITH_AES_256_CBC_SHA cipher suite. This particular configuration is vulnerable to attacks that exploit weaknesses in its design, specifically lacking features like Perfect Forward Secrecy (PFS) which would protect past communications even if the server's private key were compromised. The other options misinterpret Liam's statement – he isn't focused on performance or a misunderstanding of cipher suites; rather, he is directly pointing out a security risk.18 / 23
A security team is reviewing a recent deployment of a new microservice. The logs show frequent attempts to access sensitive data using the following TLS cipher suite: `TLS_RSA_WITH_AES_256_CBC_SHA`. Considering current best practices, what is the MOST likely concern regarding this configuration?
TLS_RSA_WITH_AES_256_CBC_SHA is a legacy cipher suite known to be vulnerable to downgrade attacks. Attackers could exploit this weakness to use older, less secure algorithms. The correct answer highlights the vulnerability and the lack of modern protections, while the other options misrepresent the risks or suggest inappropriate solutions.
19 / 23
Reviewer: 'I'm seeing a high volume of requests using the cipher suite `TLS_DHE_RSA_WITH_AES_128_CBC_SHA`. This is considered weak and susceptible to attacks. Should we immediately request a code change to migrate all API endpoints to a stronger cipher like `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`?
The reviewer correctly identifies a security concern. While immediate action might seem tempting, a phased approach with testing is crucial to avoid disrupting service and ensuring compatibility. Stronger cipher suites offer better protection against known vulnerabilities like timing attacks and downgrade assaults. A phased migration allows for controlled risk management.
20 / 23
Sarah: 'Hey team, I've noticed a significant number of API calls are still using `TLS_RSA_WITH_AES_256_CBC_SHA`. Our security policy mandates TLS 1.3 with modern cipher suites for all new deployments. What is the *primary* reason we should address this inconsistency?
The core issue here isn't performance or client compatibility; it's a direct violation of the established security policy. Using outdated cipher suites exposes the application to known vulnerabilities like downgrade attacks and can compromise data confidentiality. Adhering to the policy is paramount for maintaining a secure system.
21 / 23
During a standup meeting, Dev: 'I've just deployed a new version of the user authentication service. I'm using `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` as the cipher suite for all connections. Can anyone confirm this is aligned with our security best practices?'. What is Dev's *primary* goal in asking this question?
Dev's question isn't about technical details or deployment; it's a proactive check for alignment with established security practices. He's seeking confirmation that his actions are in line with the team's overall security posture and to avoid potential issues.
22 / 23
A Slack message from a junior developer: 'I'm confused about certificate pinning. Does it mean we need to manually manage every single certificate used by our API?
The junior developer's confusion highlights a common misunderstanding. Certificate pinning *does* involve manual management – specifically, storing and verifying the public key of the server's certificate to ensure it hasn't been tampered with. This strengthens security by preventing attackers from substituting fraudulent certificates.
23 / 23
In a code review comment, a senior developer writes: 'I'm concerned about the lack of support for modern cipher suites in this implementation. We should prioritize migrating to TLS 1.3 with AES-GCM for enhanced security and performance.' What is the *underlying* reason behind this recommendation?
The recommendation stems from a combination of factors. TLS 1.3 itself introduces performance improvements and reduces overhead. Furthermore, using modern cipher suites like AES-GCM provides stronger encryption and mitigates vulnerabilities associated with older, deprecated ciphers.
Frequently Asked Questions
What does the "Cryptographic Protocol Vocabulary Quiz" exercise cover?
Learn cryptographic protocol vocabulary: TLS 1.2 vs 1.3, cipher suites, perfect forward secrecy, certificate pinning, and enforcing minimum TLS versions.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "Cryptographic Protocol Vocabulary Quiz"?
This exercise has 23 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Cryptography & PKI exercises?
Browse the full Cryptography & PKI hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.