F5 Networks Exam 301b Topic 3 Question 68 Discussion

Actual exam question for F5 Networks's 301b exam

Question #: 68
Topic #: 3

[All 301b Questions]

Given this as the first packet displayed of an ssldump:

2 2 1296947622.6313 (0.0001) S>CV3.1(74) Handshake

ServerHello

random[32]=

19 21 d7 55 c1 14 65 63 54 23 62 b7 c4 30 a2 f0

b8 c4 20 06 86 ed 9c 1f 9e 46 0f 42 79 45 8a 29

session_id[32]=

c4 44 ea 86 e2 ba f5 40 4b 44 b4 c2 3a d8 b4 ad

4c dc 13 0d 6c 48 f2 70 19 c3 05 f4 06 e5 ab a9

cipherSuite TLS_RSA_WITH_RC4_128_SHA

compressionMethod NULL

In reviewing the rest of the ssldump, the application data is NOT being decrypted.

Why is ssldump failing to decrypt the application data?

AThe application data is encrypted with SSLv3.

BThe application data is encrypted with TLSv1.

CThe data is contained within a resumed TLS session.

DThe BigDB Key Log.Tcpdump.Level needs to be adjusted.

Show Suggested Answer

Suggested Answer: D

by Chau at Mar 30, 2023, 04:35 PM

Limited Time Offer

25%

Off

Get Premium 301b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ranee

1 months ago

Wait, doesn't the ServerHello indicate that the session is not resumed? I'm leaning towards option B being the correct answer.

upvoted 0 times

Cyril

8 days ago

User 2: Yeah, I agree. That points to option B, TLSv1 encryption.

upvoted 0 times

...

Gary

13 days ago

User 1: I think the ServerHello shows it's not a resumed session.

upvoted 0 times

...

Rasheeda

1 months ago

Haha, the 'BigDB Key Log.Tcpdump.Level' made me chuckle. I bet the developers had a hard time coming up with that one.

upvoted 0 times

...

Dyan

1 months ago

I'm not sure about the resumed TLS session part, but the cipherSuite indicates it's using RC4, so maybe that's the issue?

upvoted 0 times

Cecil

9 days ago

C) The data is contained within a resumed TLS session.

upvoted 0 times

...

Stacey

25 days ago

B) The application data is encrypted with TLSv1.

upvoted 0 times

...

Lucille

1 months ago

A) The application data is encrypted with SSLv3.

upvoted 0 times

...

Coral

2 months ago

Hmm, I think the key log needs to be adjusted, so option D might be the right answer here.

upvoted 0 times

Raymon

13 days ago

Maybe the application data is encrypted with SSLv3.

upvoted 0 times

...

Jamika

16 days ago

I think it's because the data is contained within a resumed TLS session.

upvoted 0 times

...

Katlyn

1 months ago

I agree, the key log might need to be adjusted.

upvoted 0 times

...

Fletcher

2 months ago

The application data is encrypted with TLSv1, not SSLv3, so option A is incorrect.

upvoted 0 times

...

Jamal

2 months ago

But could it also be because the data is contained within a resumed TLS session?

upvoted 0 times

...

Pamella

2 months ago

I agree with Han, it makes sense given the ssldump.

upvoted 0 times

...

Han

3 months ago

I think the application data is encrypted with SSLv3.

upvoted 0 times

...