Study. uk . com
  1. Home
  2. All questions
  3. Question 80

CISSP study material · question 80 of 500

An architect is rewriting the transport security standard for a bank's public APIs ahead of an audit. Legacy clients still negotiate TLS 1.0 and cipher block chaining (CBC) suites, and the bank holds customer records that must stay confidential for decades. Under OWASP's 2025 cryptographic guidance, which two requirements belong in the standard? Choose two.

  1. Retain the CBC-mode cipher suites as a negotiated fallback so that legacy clients keep connecting.
  2. Begin migrating the systems holding long-lived confidential records to post-quantum algorithms now.
  3. Refuse any negotiation below TLS 1.2 and offer only cipher suites that provide forward secrecy.
  4. Redirect plain HTTP requests to HTTPS instead of enforcing HTTP Strict Transport Security (HSTS).
Show the answer

Answer: C. Refuse any negotiation below TLS 1.2 and offer only cipher suites that provide forward secrecy.
B. Begin migrating the systems holding long-lived confidential records to post-quantum algorithms now.

TLS 1.2 is the floor, forward secrecy is required, and decades-long secrets demand post-quantum migration starting now. Keeping CBC suites for legacy clients preserves exactly the exposure the guidance drops.

Source: OWASP Top 10 A04:2025 (OWASP) — A04:2025 Cryptographic Failures > How to prevent

Challenge yourself on this topic → Study as cards